Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

Post reply on HN
Print view View original

751–760 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#751

Post by lqstuart »

keeganpoppen wrote: post #529
mohsen1 wrote: post #102

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

the claude code team ethos, as far as i’ve been lead to understand— which i agree with, mind you— is that there is no point in code-reviewing ai-generated code… simply update your spec(s) and regenerate. it is just a completely different way of interacting with the world. but it clearly works for them, so people throwing up their hands should at least take notice of the fact that they are absolutely not competing wit…

yes, because who ever heard of an AI leaking passwords or API keys into source code

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#753

Post by Galanwe »

gman83 wrote: post #111

Gemini CLI and Codex are open source anyway. I doubt there was much of a moat there anyway. The cool kids are using things like https://pi.dev/ anyway.

> I doubt there was much of a moat there anyway.

There is _a lot_ of moat. Claude subscriptions are limited to Claude Code. There are proxies to impersonate Claude Code specifically for this, but Anthropic has a number of fingerprinting measures both client and server side to flag and ban these.

With the release of this source code, Anthropic basically lost the lock-in game, any proxy can now perfectly mimic Claude Code.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#754

Post by bdangubic »

batshit_beaver wrote: post #698
jen20 wrote: post #661

Earlier quoted context omitted.

(I mostly agree with you, but) devils advocate: most people already do that with dependencies, so why not move the line even further up?

Because you trust that your dependencies are not vibe coded and have been reviewed by humans.

except they are vibe-or-not coded by some dude in Reno NV who wouldn’t pass a phone screen where you work

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#755

Post by tomaskafka »

true_religion wrote: post #460
cyanydeez wrote: post #453

Earlier quoted context omitted.

So, think of it as a business man: You don't really care if your customers swear or whatever, but you know that it'll generate bad headlines. So you gotta do something. Just like a door lock isn't designed for a master criminal, you don't need to design your filter for some master swearer; no, you design it good enough that it gives the impression that further tries are futile. So yeah, you do what's less intesive to…

This door lock doesn’t even work against people speaking French, so I think they could have tried a mite harder.

Nom de dieu de putain de bordel de merde de saloperie de connard d'enculé de ta mère.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#756

Post by sheeshkebab »

Obfuscated ts/js code is not machine code to begin with, so not sure what’s the big deal.

Also, not sure why anthropic doesn’t just make their cli open source - it’s not like it’s something special (Claude is, this cli thingy isn’t)

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#757

Post by nico »

jollymonATX wrote: post #530
nico wrote: post #524

Earlier quoted context omitted.

Probably a lot of my prompts have been logged then. I’ve used wtf so many times I’ve lost track. But I guess Claude hasn’t

Did you notice a change in quality after you went foul?

Not really. Most of the times it actually finally picks up on what I was telling it to do. Sometimes it takes a few tries, like 2-3 wtfs. I don’t think I’ve ever given it more than 3 consecutive wtfs, and that would be a lot

It’s about a once a week or less event. A bit annoying sometimes, but not a deal breaker

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#760

Post by petcat »

sheeshkebab wrote: post #756

Obfuscated ts/js code is not machine code to begin with, so not sure what’s the big deal. Also, not sure why anthropic doesn’t just make their cli open source - it’s not like it’s something special (Claude is, this cli thingy isn’t)

> not sure why anthropic doesn’t just make their cli open source

They don't want everyone to see how poorly it's implemented and that the whole thing is a big fragile mess riddled with bugs. That's my experience anyway.

For instance, just recently their little CLI -> browser oauth login flow was generating malformed URLs and URLs pointing to a localhost port instead of their real website.

Post reply on HN