Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#621

Post by FuckButtons »

VadimPR wrote: post #452

These security failures from Anthropic lately reveal the caveats of only using AI to write code - the safety an experienced engineer is not matched by an LLM just yet, even if the LLM can seemingly write code that is just as good. Or in short, if you give LLMs to the masses, they will produce code faster, but the quality overall will degrade. Microsoft, Amazon found out this quickly. Anthropic's QA process is better…

To a certain extent, I do wonder if just letting claude do everything and then using the bug reports and CVE’s they find as training data for an RL environment might be part of the plan. “Here’s what you did, here’s what fixed it, don’t fuck up like that again"

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#622

Post by encoderer »

arcanemachiner wrote: post #609
lanbin wrote: post #571

Earlier quoted context omitted.

Open Claude Code? Better than OpenCode and Codex

I wish. Claude Code is clearly a pile of vibe-coded garbage. The UI is janky and jumps all over the place, especially during longer sessions. (Which also have a several second delay to render. In a terminal). Lately, it's been crashing if I hold the Backspace key down for too long. Being open-source would be the best thing to happen to them. At least they would finally get a pair of human eyes looking at their codeba…

As a point of reference, I’m a heavy cc user and I’ve had a few bugs but I’ve never had the terminal glitches like this. I use iterm on macOS sequoia.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#623

Post by anonym29 »

stackghost wrote: post #606
0x3f wrote: post #134

Earlier quoted context omitted.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

I am actively building non-magical human verification technology that doesn't require you uploading your retinal scans or ID to billionaires or incompetent outsourcing firms.

The technical implementation is the easy part. The hard part is achieving mass voluntary cooperation under adverse incentive schemes.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#625

Post by kolkov »

johnfn wrote: post #490
kolkov wrote: post #351

[flagged]

This is written by an LLM. Also, it doesn't make sense: > 57K lines, 0 tests, vibe coding in production Why on earth would you ship your tests?

"Why would you ship tests?" — Fair point. Source maps only include production bundle files — tests wouldn't appear in the map regardless. Tests may well exist in Anthropic's internal repo, and we can't claim otherwise. However, the bugs we found speak for themselves: a watchdog that doesn't protect the most vulnerable code path for 5+ months, a fallback with telemetry that never executes where it's needed, Promise.race without catch silently dropping tool results. If tests exist, they clearly don't cover the streaming pipeline adequately — these are the kind of issues that even basic integration tests would catch.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#626

Post by kami23 »

jaapz wrote: post #617
foob wrote: post #552

Amusingly, they deprecated it with a message of "Unpublished" instead of actually unpublishing it [1]. When you use npm unpublish it removes the package version from the registry, when you use npm deprecate it leaves it there and simply marks the package as deprecated with your message. I have to imagine the point was to make it harder for people to download the source map, so to deprecate it with this message gives…

You can say what you want about anthropic but they sure as hell are dogfooding the crap out of claude code lmao

In all my years of writing tools for other devs, dog fooding is the really the best way to develop IMO. The annoying bugs get squashed out because I get frustrated with it in my flow.

Iterating on a MCP tool while having Claude try to use it has been a really great way of getting it to work how others are going to use it coming in blind.

Yes it's buggy as hell, but as someone echoed earlier if the tool works most of the time, a lot of people don't care. Moving fast and breaking things is the way in an arms race.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#627

Post by stackghost »

tlonny wrote: post #620
stackghost wrote: post #606

Earlier quoted context omitted.

I am actively building non-magical human verification technology that doesn't require you uploading your retinal scans or ID to billionaires or incompetent outsourcing firms.

how does it work?

I'm hoping to do a Show HN soon :)

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#628

Post by stackghost »

anonym29 wrote: post #623
stackghost wrote: post #606

Earlier quoted context omitted.

I am actively building non-magical human verification technology that doesn't require you uploading your retinal scans or ID to billionaires or incompetent outsourcing firms.

The technical implementation is the easy part. The hard part is achieving mass voluntary cooperation under adverse incentive schemes.

This is true, but I think there is a sizable (and growing) appetite for human-only spaces.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#629

Post by hanspagel »

foob wrote: post #552

Amusingly, they deprecated it with a message of "Unpublished" instead of actually unpublishing it [1]. When you use npm unpublish it removes the package version from the registry, when you use npm deprecate it leaves it there and simply marks the package as deprecated with your message. I have to imagine the point was to make it harder for people to download the source map, so to deprecate it with this message gives…

You can’t unpublish a npm package with more than 100 downloads I think.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#630

Post by lynx97 »

stackghost wrote: post #606
0x3f wrote: post #134

Earlier quoted context omitted.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

I am actively building non-magical human verification technology that doesn't require you uploading your retinal scans or ID to billionaires or incompetent outsourcing firms.

Great! Lets do the CAPTCHA-test: Will I, as a 100% blind user, be able to complete your process?
Post reply on HN