Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

Post reply on HN
Print view View original

121–130 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#121

Post by worksonmine »

Overpower0416 wrote: post #53
Insensitivity wrote: post #17

Earlier quoted context omitted.

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across. It's extremely nested, it's basically an if statement soup `useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

export function extractSearchToken(completionToken: { token: string; isQuoted?: boolean; }): string { if (completionToken.isQuoted) { // Remove @" prefix and optional closing " return completionToken.token.slice(2).replace(/"$/, ''); } else if (completionToken.token.startsWith('@')) { return completionToken.token.substring(1); } else { return completionToken.token; } } Why even use else if with return...

> Why even use else if with return...

What is the problem with that? How would you write that snippet? It is common in the new functional js landscape, even if it is pass-by-ref.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#122

Post by jedisct1 »

prmoustache wrote: post #108
jedisct1 wrote: post #100

It shows that a company you and your organization are trusting with your data, and allowing full control over your devices 24/7, is failing to properly secure its own software. It's a wake up call.

It is a client running on an interpreted language your own computer, there is nothing to secure or hide as source was provided to you already or am I mistaking?

It was heavily obfuscated, keeping users in the dark about what they’re installing and running.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#123

Post by moontear »

bkryza wrote: post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

I don't know about avoided, this kind of represents the WTF per minute code quality measurement. When I write WTF as a response to Claude, I would actually love if an Antrhopic engineer would take a look at what mess Claude has created.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#124

Post by [deleted] »

stingraycharles wrote: post #110
BoppreH wrote: post #103

Earlier quoted context omitted.

An LLM company using regexes for sentiment analysis? That's like a truck company using horses to transport parts. Weird choice.

Because they want it to be executed quickly and cheaply without blocking the workflow? Doesn’t seem very weird to me at all.

[deleted]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#125

Post by mrlnstk »

BoppreH wrote: post #113

Undercover mode also pretends to be human, which I'm less ok with: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

But will this be released as a feature? For me it seems like it's an Anthropic internal tool to secretly contribute to public repositories to test new models etc.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#126

Post by codegladiator »

BoppreH wrote: post #103
bkryza wrote: post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

An LLM company using regexes for sentiment analysis? That's like a truck company using horses to transport parts. Weird choice.

what you are suggesting would be like a truck company using trucks to move things within the truck

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#127

Post by linesofcode »

q3k wrote: post #9

The code looks, at a glance, as bad as you expect.

Code quality no longer carries the same weight as it did pre LLMs. It used to matter becuase humans were the ones reading/writing it so you had to optimize for readability and maintainability. But these days what matters is the AI can work with it and you can reliably test it. Obviously you don’t want code quality to go totally down the drain, but there is a fine balance.

Optimize for consistency and a well thought out architecture, but let the gnarly looking function remain a gnarly function until it breaks and has to be refactored. Treat the functions as black boxes.

Personally the only time I open my IDE to look at code, it’s because I’m looking at something mission critical or very nuanced. For the remainder I trust my agent to deliver acceptable results.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#128

Post by hk__2 »

BoppreH wrote: post #118
lou1306 wrote: post #105

Earlier quoted context omitted.

They're searching for multiple substrings in a single pass, regexes are the optimal solution for that.

It's fast, but it'll miss a ton of cases. This feels like it would be better served by a prompt instruction, or an additional tiny neural network. And some of the entries are too short and will create false positives. It'll match the word "offset" ("ffs"), for example. EDIT: no it won't, I missed the \b. Still sounds weird to me.

It’s fast and it matches 80% of the cases. There’s no point in overengineering it.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#129

Post by BoppreH »

mrlnstk wrote: post #125
BoppreH wrote: post #113

Undercover mode also pretends to be human, which I'm less ok with: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

But will this be released as a feature? For me it seems like it's an Anthropic internal tool to secretly contribute to public repositories to test new models etc.

I don't care who is using it, I don't want LLMs pretending to be humans in public repos. Anthropic just lost some points with me for this one.

EDIT: I just realized this might be used without publishing the changes, for internal evaluation only as you mentioned. That would be a lot better.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#130

Post by yunwal »

bob1029 wrote: post #11

Is this significant? Copilot on OAI reveals everything meaningful about its functionality if you use a custom model config via the API. All you need to do is inspect the logs to see the prompts they're using. So far no one seems to care about this "loophole". Presumably, because the only thing that matters is for you to consume as many tokens per unit time as possible. The source code of the slot machine is not relev…

> The source code of the slot machine is not relevant to the casino manager.

Famously code leaks/reverse engineering attempts of slot machines matter enormously to casino managers

[0] -https://en.wikipedia.org/wiki/Ronald_Dale_Harris#:~:text=Ron...

[1] - https://cybernews.com/news/software-glitch-loses-casino-mill...

[2] - https://sccgmanagement.com/sccg-news/2025/9/24/superbet-pays...

Post reply on HN