Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

571–580 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#571

I think this is ultimately caused by a Bun bug which I reported, which means source maps are exposed in production: https://github.com/oven-sh/bun/issues/28001 Claude code uses (and Anthropic owns) Bun, so my guess is they're doing a production build, expecting it not to output source maps, but it is.

Open Claude Code?

Better than OpenCode and Codex

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#572

I don't understand why claude code (and all CLI apps) isn't written in Rust. I started building CLI agents in Go and then moved to Typescript and finally settled on Rust and it was amazing! I even made it into an open source runtime - https://agent-air.ai . Maybe I'm just a backend engineer so Rust appeals to me. What am I missing?

While the LLM rust experiments I've been running make good use of ADTs, it seems to have trouble understanding lifetimes and when it should be rc/arc-ing.

Perhaps these issues have known solutions? But so far the LLM just clones everything.

So I'm not convinced just using rust for a tool built by an LLM is going to lead to the outcome that you're hoping for.

[Also just in general abstractions in rust feel needlessly complicated by needing to know the size of everything. I've gotten so much milage by just writing what I need without abstraction and then hoping you don't have to do it twice. For something (read: claude code et al) that is kind of new to everyone, I'm not sure that rust is the best target language even when you take the LLM generated nature of the beast out of the equation.]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#573

Really surprising how many people are downplaying this leak! "Google and OpenAi have already open sourced their Agents, so this leak isn't that relevant " What Google and OpenAi have open sourced is their Agents SDK, a toolkit, not the secret sauce of how their flagship agents are wired under the hood! expect the takedown hammer on the tweet, the R2 link, and any public repos soon

It doesn't matter that much. Trust me you could just have an LLM reverse engineer the obfuscated code.

yeah it actually works to use claude to reverse engineer itself; I've used that to workaround some problems. E.g. that's how I discovered that I had to put two slashes for absolute paths in sandbox config. The thing is, the claude team is so quick that soon enough they add more and more features and fix more and more bugs that your workarounds become obsolete

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#574

Earlier quoted context omitted.

The difference in response time - especially versus a regex running locally - is really difficult to express to someone who hasn't made much use of LLM calls in their natural language projects. Someone said 10,000x slower, but that's off - in my experience - by about four orders of magnitude. And that's average, it gets much worse. Now personally I would have maybe made a call through a "traditional" ML widget (sciki…

> Someone said 10,000x slower, but that's off - in my experience - by about four orders of magnitude. You do know that 10,000x _is_ four orders of magnitude, right? :-D

OP is saying that in their experience it is more like eight orders of magnitude

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#575
post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

We used this in 2011 at the startup I worked for. 20 positive and 20 negative words was good enough to sell Twitter "sentiment analysis" to companies like Apple, Bentley, etc...

Did you also forget to ignore case sensitivity back then?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#576
post #251

Earlier quoted context omitted.

What's going on with the issues in that repo? https://github.com/instructkr/claude-code/issues

It seems human. It taught me 合影, which seems to be Chinese slang for just wanting to be in the comments. Probably not a coincidence that it's after work time in China. Really interesting to see Github turn into 4chan for a minute, like GH anons rolling for trips.

合影 doesn't sound like any Chinese slang. That is just what "group photo" means.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#577
post #7

The big loss for Anthropic here is how it reveals their product roadmap via feature flags. A big one is their unreleased "assistant mode" with code name kairos. Just point your agent at this codebase and ask it to find things and you'll find a whole treasure trove of info. Edit: some other interesting unreleased/hidden features - The Buddy System: Tamagotchi-style companion creature system with ASCII art sprites - Un…

Note also the "Claude Capybara" reference in the undercover prompt: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

At least this was known with the Mythos "early blog post" fiasco.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#578

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

the claude code team ethos, as far as i’ve been lead to understand— which i agree with, mind you— is that there is no point in code-reviewing ai-generated code… simply update your spec(s) and regenerate. it is just a completely different way of interacting with the world. but it clearly works for them, so people throwing up their hands should at least take notice of the fact that they are absolutely not competing wit…

I see. They got unlimited tokens, right?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#579
post #302

Earlier quoted context omitted.

They stole everything and now they want to close the gates behind them. "I got the loot, Steve!" I feel like the distillation stuff will end up in court if they try to sue an American company about it. We'll see what a judge says.

You're perfectly free to scrape the web yourself and train your own model. You're not free to let Anthropic do that work for you, because they don't want you to, because it cost them a lot of time and money and secret sauce presumably filtering it for quality and other stuff. Stole? Courts have ruled it's transformative, and it very obviously is. AI doomerism is exhausting, and I don't even use AI that much, it's jus…

reminds me of `don't look up` a bit. there clearly is an imbalance in regards to licenses with model providers, not even talking about knowledge extraction (yes younger people don't learn properly now, older generations forget) shortly before the rug-pull happens in form of accessibility to not rich people

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#580

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

here's another gem. src/ink/termio/osc.ts:192–210 void execFileNoThrow('wl-copy', [], opts).then(r => { if (r.code === 0) { linuxCopy = 'wl-copy'; return } void execFileNoThrow('xclip', ...).then(r2 => { if (r2.code === 0) { linuxCopy = 'xclip'; return } void execFileNoThrow('xsel', ...).then(r3 => { linuxCopy = r3.code === 0 ? 'xsel' : null }) }) }) are we doing async or not?

A defining work of the "just vibes" era.
Post reply on HN