Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

41–50 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#41
post #21

Earlier quoted context omitted.

Can you give an example? Looks fairly decent to me

1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too. 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs. 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

What is wrong with peeking at process.env? It is a global map, after all. I assume, of course, that they don't mutate it.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#43
post #35

Codex and gemini cli are open source already. And plenty of other agents. I don't think there is any moat in claude code source.

Well, Claude does boast an absolutely cursed (and very buggy) React-based TUI renderer that I think the others lack! What if someone steals it and builds their own buggy TUI app?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#44

I wonder what will happen with the poor guy who forgot to delete the code...

Responsibility goes upwards.

Why weren't proper checks in place in the first place?

Bonus: why didn't they setup their own AI-assisted tools to harness the release checks?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#45
I have a feeling this is like llama.

Original llama models leaked from meta. Instead of fighting it they decided to publish them officially. Real boost to the OS/OW models movement, they have been leading it for a while after that.

It would be interesting to see that same thing with CC, but I doubt it'll ever happen.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#49
post #41
post #21

Earlier quoted context omitted.

1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too. 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs. 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

What is wrong with peeking at process.env? It is a global map, after all. I assume, of course, that they don't mutate it.

For one it's harder to unit test.
Post reply on HN