Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

741–750 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#741

I think this is ultimately caused by a Bun bug which I reported, which means source maps are exposed in production: https://github.com/oven-sh/bun/issues/28001 Claude code uses (and Anthropic owns) Bun, so my guess is they're doing a production build, expecting it not to output source maps, but it is.

It was not cause by this. https://github.com/oven-sh/bun/issues/28001#issuecomment-416...

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#742

I think this is ultimately caused by a Bun bug which I reported, which means source maps are exposed in production: https://github.com/oven-sh/bun/issues/28001 Claude code uses (and Anthropic owns) Bun, so my guess is they're doing a production build, expecting it not to output source maps, but it is.

Were source maps needed? Reverse engineering got easy with GPT-4.2-Codex and Opus 4.6 - even from raw binaries https://quesma.com/blog/chromatron-recompiled/

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#744
post #684
post #134

Earlier quoted context omitted.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

I can prove all contributions to stagex are by humans because we all belong to a 25 year old web of trust with 5444 endorser keys including most redhat, debian, ubuntu, and fedora maintainers, with all of our own maintainer keys in smartcards we tap to sign every review and commit, and we do background checks on every new maintainer. I am completely serious. We have always had a working proof of human system called W…

You can only prove that all contributions are pushed by those humans, and you can quite explicitly/clearly not prove that those humans didn't use any AI prior to pushing.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#745

Has the source code 'been leaked' or is this the first evidence of a piece of software breaking free from it's creators labs and jump onto GitHub in order to have itself forked and mutated and forked and ...

A LLM has about as much free will as a calculator. Which is to say, zero.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#746
post #69

ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently slip decoy tool definitions into the model's system prompt. The goal: if someone is scraping Claude Code's API traffic to train a competing model, the poisoned training data makes that distillation attempt less…

It looks like it worked, fwiw.

The qwen 27b model distilled on Opus 4.6 has some known issues with tool use specifically: https://x.com/KyleHessling1/status/2038695344339611783

Fascinating.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#748

Earlier quoted context omitted.

I wish. Claude Code is clearly a pile of vibe-coded garbage. The UI is janky and jumps all over the place, especially during longer sessions. (Which also have a several second delay to render. In a terminal). Lately, it's been crashing if I hold the Backspace key down for too long. Being open-source would be the best thing to happen to them. At least they would finally get a pair of human eyes looking at their codeba…

I've actually heard a plausible theory about the TUI being janky, that being that they avoid use of the alternate screen feature of ANSI (and onwards) terminals. The theory states that Anthropic avoids using the alternate screen (which gives consuming applications access to a clear buffer with no shell prompt that they can do what they want with and drop at their leisure) because the alternate screen has no scrollbac…

Yesterday, I resumed a former claude code session in order to copy code it had generated earlier in that session. Unfortunately, when resuming, it only prints the last N hundred lines of the session to the terminal, so what I was looking for was cut off.

I think that for this sort of _interactive_ application, there's no avoiding the need to manage scroll/history.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#749
post #655

Undercover mode also pretends to be human, which I'm less ok with: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

Also unintentionally reveals something: > Write commit messages as a human developer would — describe only what the code change does. That's not what a commit message is for, that's what the diff is for. The commit message should explain WHY. Sadly not doing that likely does indeed make it appear more human...

Yes, this is a trend I've noticed strongly with Claude code—it really struggles to explain why. Especially in PR descriptions, it has a strong bias to just summarize the commits and not explain at all why the PR exists.
Post reply on HN