Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

Post reply on HN
Print view View original

301–310 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#301

Post by plorntus »

Foobar8568 wrote: post #171
stingraycharles wrote: post #110

Earlier quoted context omitted.

Because they want it to be executed quickly and cheaply without blocking the workflow? Doesn’t seem very weird to me at all.

Why do you need to do it at the client side? You are leaking so much information on the client side. And considering the speed of Claude code, if you really want to do on the client side, a few seconds won't be a big deal.

Depends what its used by, if I recall theres an `/insights` command/skill built in whatever you want to call it that generates a HTML file. I believe it gives you stats on when you're frustrated with it and (useless) suggestions on how to "use claude better".

Additionally after looking at the source it looks like a lot of Anthropics own internal test tooling/debug (ie. stuff stripped out at build time) is in this source mapping. Theres one part that prompts their own users (or whatever) to use a report issue command whenever frustration is detected. It's possible its using it for this.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#302

Post by petcat »

nialse wrote: post #290
cedws wrote: post #69

ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently slip decoy tool definitions into the model's system prompt. The goal: if someone is scraping Claude Code's API traffic to train a competing model, the poisoned training data makes that distillation attempt less…

Paranoia. And also ironic considering their base LLM is a distillation of the web and books etc etc.

They stole everything and now they want to close the gates behind them.

"I got the loot, Steve!"

I feel like the distillation stuff will end up in court if they try to sue an American company about it. We'll see what a judge says.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#303

Post by spiderfarmer »

nialse wrote: post #290
cedws wrote: post #69

ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently slip decoy tool definitions into the model's system prompt. The goal: if someone is scraping Claude Code's API traffic to train a competing model, the poisoned training data makes that distillation attempt less…

Paranoia. And also ironic considering their base LLM is a distillation of the web and books etc etc.

That isn't irony, it's hypocrisy.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#304

Post by floralhangnail »

BoppreH wrote: post #103
bkryza wrote: post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

An LLM company using regexes for sentiment analysis? That's like a truck company using horses to transport parts. Weird choice.

Well, regex doesn't hallucinate....right?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#305

Post by ccvannorman »

bkryza wrote: post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

you'd better be careful wth your typos, as well

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#306

Post by tokioyoyo »

catlifeonmars wrote: post #161
tokioyoyo wrote: post #54

Earlier quoted context omitted.

Team has been extremely open how it has been vibe coded from day 1. Given the insane amount of releases, I don’t think it would be possible without it.

It’s not a particularly sophisticated tool. I’d put my money on one experienced engineer being able to achieve the same functionality in 3-6 months (even without the vibe coding).

The same functionality can be copied over in a week most likely. The moat is experimentation and new feature releases with the underlying model. An engineer would not be able to experiment with the same speed.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#307

Post by arthur-st »

ghywertelling wrote: post #263
jsk2600 wrote: post #60

Earlier quoted context omitted.

Original author of Claude Code is expert on TypeScript [1] [1] https://www.amazon.com/Programming-TypeScript-Making-JavaScr...

is that the reason why Anthropic acquired Bun, a javascript tooling company?

Yes, that's essentially the only practical reason.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#308

Post by crimsonnoodle58 »

mycall wrote: post #210
_fizz_buzz_ wrote: post #169

Earlier quoted context omitted.

They probably have statistics on it and saw that certain phrases happen over and over so why waste compute on inference.

The problem with regex is multi-language support and how big the regex will bloat if you to support even 10 languages.

They only need to look at one language to get a statistically meaningful picture into common flaws with their model(s) or application.

If they want to drill down to flaws that only affect a particular language, then they could add a regex for that as well/instead.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#309

Post by nananana9 »

francisofascii wrote: post #253
bkryza wrote: post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

Interesting that expletives and words that are more benign like "frustrating" are all classified the same.

I doubt they're all classified the same. I'd guess they're using this regex as a litmus test to check if something should be submitted at all, they can then do deeper analysis offline after the fact.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#310

Post by tokioyoyo »

mattmanser wrote: post #220
tokioyoyo wrote: post #74

Earlier quoted context omitted.

Genuinely I have no idea what you mean by buggy. Sure there are some problems here and there, but my personal threshold for “buggy” is much higher. I guess, for a lot of other people as well, given the uptake and usage.

Two weeks ago typing became super laggy. It was totally unusable. Last week I had to reinstall Claude Desktop because every time I opened it, it just hung. This week I am sometimes opening it and getting a blank screen. It eventually works after I open it a few times. And of course there's people complaining that somehow they're blowing their 5 hour token budget in 5 messages. It's really buggy. There's only so long…

And those bugs were semi-fixed and people are still using it. So speed of fixes are there.

I can’t comment on Claude Desktop, sorry. Personally haven’t used it much.

The token usage looks like is intentional.

And I agree about the underlying model being the moat. If there’s something marginally better that comes up, people will switch to it (myself included). But for now it’s doing the job, despite all the hiccups, code quality and etc.

Post reply on HN