Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

141–150 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#141

Finally all spinner verbs revealed: https://github.com/instructkr/claude-code/blob/main/src/cons...

Random aside: I've seen a 2015 game be accused of AI slop on Steam because it used a similar concept... And mind you, there's probably thousands of games that do this.

First it was punctuation and grammar, then linguistic coherence, and now it's tiny bits of whimsy that are falling victim to AI accusations. Good fucking grief

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#142

Earlier quoted context omitted.

Can you give an example? Looks fairly decent to me

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across. It's extremely nested, it's basically an if statement soup `useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

I'm not that familiar with TypeScript/JavaScript - what would be a proper way of handling complex logic? Switch statements? Decision tables?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#143
post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

Yeah, this is crazy

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#144
post #41
post #21

Earlier quoted context omitted.

1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too. 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs. 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

What is wrong with peeking at process.env? It is a global map, after all. I assume, of course, that they don't mutate it.

environment variables can change while the process is running and are not memory safe (though I suspect node tries to wrap it with a lock). Meaning if you check a variable at point A, enter a branch and check it again at point B ... it's not guaranteed that they will be the same value. This can cause you to enter "impossible conditions".

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#145
post #41
post #21

Earlier quoted context omitted.

1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too. 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs. 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

What is wrong with peeking at process.env? It is a global map, after all. I assume, of course, that they don't mutate it.

> process.env? It is a global map

That's exactly why, access to global mutable state should be limited to as small a surface area as possible, so 99% of code can be locally deterministic and side-effect free, only using values that are passed into it. That makes testing easier too.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#147

Earlier quoted context omitted.

export function extractSearchToken(completionToken: { token: string; isQuoted?: boolean; }): string { if (completionToken.isQuoted) { // Remove @" prefix and optional closing " return completionToken.token.slice(2).replace(/"$/, ''); } else if (completionToken.token.startsWith('@')) { return completionToken.token.substring(1); } else { return completionToken.token; } } Why even use else if with return...

> Why even use else if with return... What is the problem with that? How would you write that snippet? It is common in the new functional js landscape, even if it is pass-by-ref.

Using guard clauses. Way more readable and easy to work with.

  export function extractSearchToken(completionToken: {
    token: string;
    isQuoted?: boolean;
  }): string {
    if (completionToken.isQuoted) {
      return completionToken.token.slice(2).replace(/"$/, '');
    }
    if (completionToken.token.startsWith('@')) {
      return completionToken.token.substring(1);
    }
    return completionToken.token;
  }

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#148
post #19

Would be interesting to run this through Malus [1] or literally just Claude Code and get open source Claude Code out of it. I jest, but in a world where these models have been trained on gigatons of open source I don't even see the moral problem. IANAL, don't actually do this. https://malus.sh/

Malus is not a real project btw, it's a parody:

“Let's end open source together with this one simple trick”

https://pretalx.fosdem.org/fosdem-2026/talk/SUVS7G/feedback/

Malus is translating code into text, and from text back into code.

It gives the illusion of clean room implementation that some companies abuse.

The irony is that ChatGPT/Claude answers are all actually directly derived from open-source code, so...

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#149

Earlier quoted context omitted.

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across. It's extremely nested, it's basically an if statement soup `useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

export function extractSearchToken(completionToken: { token: string; isQuoted?: boolean; }): string { if (completionToken.isQuoted) { // Remove @" prefix and optional closing " return completionToken.token.slice(2).replace(/"$/, ''); } else if (completionToken.token.startsWith('@')) { return completionToken.token.substring(1); } else { return completionToken.token; } } Why even use else if with return...

I always write code like that. I don't like early returns. This approximates `if` statements being an expression that returns something.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#150

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

Yes, if it was made for human comprehension or maintenance.

If it's entirely generated / consumed / edited by an LLM, arguably the most important metric is... test coverage, and that's it ?

Post reply on HN