Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

811–820 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#811
post #805

Obfuscated ts/js code is not machine code to begin with, so not sure what’s the big deal. Also, not sure why anthropic doesn’t just make their cli open source - it’s not like it’s something special (Claude is, this cli thingy isn’t)

" - it’s not like it’s something special (Claude is, this cli thingy isn’t)" How do you know? Have you checked the source? Do you know how exactly context is created, memory files, skills? Subagents created with tasks? I don't, but am checking right now. Then I will judge.

bc I build stuff like this myself - it doesn’t take anything to build a wrapper client around a good llm, including using another llm.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#812
post #134

Earlier quoted context omitted.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

It’s certainly winnable with some legislative tweaks. These systems are all designed by humans, we can just change them. Of course, we’d need a significant change of direction in leadership, but it’s happened many times before. French Revolution seems highly relevant

I think you're underestimating the difficulty, even for exact copies of text (which AI mostly isn't doing).

What sort of Orwellian anti-cheat system would prevent copy and paste from working? What sort of law would mandate that? There are elaborate systems preventing people from copying video but they still have an analog hole.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#813

Earlier quoted context omitted.

Yes, if it was made for human comprehension or maintenance. If it's entirely generated / consumed / edited by an LLM, arguably the most important metric is... test coverage, and that's it ?

LLMs are so so far away from being able to independently work on a large codebase, and why would they not benefit from modularity and clarity too?

> independently work on a large codebase

Im not sure that Humans are great at this either. Think about how we use frameworks and have complex supply chains... we sort of get "good enough" at what we need to do and pray a lot that everything else keeps working and that our tooling (things like artifactory) save us from supply chain attacks. Or we just run piles of old, outdated code because "it works". I cant tell you how many micro services I have seen that are "just fine" but no one in the current org has ever read a line of what's in them, and the people who wrote them left ages ago.

> clarity too

Yes, but define clarity!

I recently had the pleasure of fixing a chunk of code that was part of a data pipeline. It was an If/elseif/elseif structure... where the final two states were fairly benign and would have been applicable in 99 percent of cases. Everything else was to deal with the edge cases!

I had an idea of where the issue was, but I didn't understand how the code ended up in the state it was in... Blame -> find the commit message (references ticket) -> find the Jira ticket (references sales force) -> find the original customer issue in salesforce, read through the whole exchange there.

A two line comment could have spared me all that work, to get to what amounted to a dead simple fix. The code was absolutely clear, but without the "why" portion of the context I likely would have created some sort of regression, that would have passed the good enough testing that was there.

I re-wrote a portion of the code (expanding variable names) - that code is now less "scannable" and more "readable" (different types of clarity). Dropped in comments: a few sentences of explaining, and references to the tickets. Went and updated tests, with similar notes.

Meanwhile, elsewhere (other code base, other company), that same chain is broken... the "bug tracking system" that is referenced in the commit messages there no longer exists.

I have a friend who, every time he updates his dev env, he calls me to report that he "had to go update the wiki again!" Because someone made a change and told every one in a slack message. Here is yet another vast repository of degrading, unsearchable and unusable tribal knowledge embedded in so many organizations out there.

Don't even get me started on the project descriptions/goals/tasks that amount to pantomime a post-it notes, absent of any sort of genuine description.

Lack of clarity is very much also a lack of "context" in situ problem.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#814
post #760

Obfuscated ts/js code is not machine code to begin with, so not sure what’s the big deal. Also, not sure why anthropic doesn’t just make their cli open source - it’s not like it’s something special (Claude is, this cli thingy isn’t)

> not sure why anthropic doesn’t just make their cli open source They don't want everyone to see how poorly it's implemented and that the whole thing is a big fragile mess riddled with bugs. That's my experience anyway. For instance, just recently their little CLI -> browser oauth login flow was generating malformed URLs and URLs pointing to a localhost port instead of their real website.

I don't think you really need to look at the source code to understand that it's probably been, let's say, written with a heavy help from Claude itself

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#815

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

Yes, if it was made for human comprehension or maintenance. If it's entirely generated / consumed / edited by an LLM, arguably the most important metric is... test coverage, and that's it ?

Unit testing is much much harder when you have functions spanning thousands of lines and no abstractions. You have to white box test everything to ensure that you hit all code paths, and it is much more expensive to maintain such tests, both as a human and LLM. I don't think this can be ignored just because LLMs are writing the code.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#817
post #567

Earlier quoted context omitted.

Fatalism will also not fix anything. But I suppose death comes for us all, yes? Why do anything at all?

I feel that fatalism, especially when people treat it as some sort of personal philosophy, is kind of lazy. It requires no effort to say "fuck this, nothing matters anyway", and then justify doing literally nothing.

This is more cultural rather than rational.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#818

Obfuscated ts/js code is not machine code to begin with, so not sure what’s the big deal. Also, not sure why anthropic doesn’t just make their cli open source - it’s not like it’s something special (Claude is, this cli thingy isn’t)

Naming conventions can reveal a lot about how teams internally are thinking about roadmap and product decisions.

That cannot be reversed when obfuscated.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#819
post #567

Earlier quoted context omitted.

Fatalism will also not fix anything. But I suppose death comes for us all, yes? Why do anything at all?

> But I suppose death comes for us all, yes? Why do anything at all? Wrong take. Death comes for us all, yes, so why hold back? Do you want to live forever?

> Do you want to live forever?

Yes, of course. Do you prefer to die? Those are the only two alternatives, and a decision that you don't want one is a decision that you prefer the other.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#820
post #784

Earlier quoted context omitted.

I feel that fatalism, especially when people treat it as some sort of personal philosophy, is kind of lazy. It requires no effort to say "fuck this, nothing matters anyway", and then justify doing literally nothing.

It also makes no sense! "Fuck this, it doesn't matter - but I'll happily spend effort communicating that to others, because apparently making others not care about something I don't care about is something I do care about." Wut?! Well, I say it makes no sense. Alternatively, it makes a lot of sense, and these people actually just wanna destroy everything we hold dear :-(

Perhaps the current societal trajectory is destroying everything that they hold dear.

I mean, just look around you.

Post reply on HN