Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

901–910 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#901

Earlier quoted context omitted.

While not directly related to GP, I would guess that a codebase developped with a coding agent (I assume Claude code is used to work on itself) would benefit from a stricter type system (one important point of Rust)

TypeScript is typed.. It's in the name ?

Yes, but if you put type strictness on a line, Rust would be further along I think.

Not to say that Typescript is bad or anything, but I would like to see data on my gut feeling that "stricter languages would make coding agents work better"

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#902

Earlier quoted context omitted.

First time I hear about this, it's interesting to have written all of this out. Now this makes me think of game decompilation projects, which would seem to fall in the same legal area as code that would be generated by something like Malus. Different code, same end result (binary or api). We definitely need to know what the legal limits are and should be

Semi-related, someone made basically Malus-for-San-Andreas: https://www.youtube.com/watch?v=zBQJYMKmwAs

That's fascinating !

I think it's worth posting as its own submission (if it wasn't already).

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#903

Earlier quoted context omitted.

Random aside: I've seen a 2015 game be accused of AI slop on Steam because it used a similar concept... And mind you, there's probably thousands of games that do this. First it was punctuation and grammar, then linguistic coherence, and now it's tiny bits of whimsy that are falling victim to AI accusations. Good fucking grief

All that is needed to solve that is to reliably put AI disclaimer on things done by AI Which of course won't be done because corporations don't want that (except Valve I guess), so blame them.

> all that needs to be done

The honor system is never a sustainable solution. It's not even down to corporate greed, it's just not something that works at scale, especially when there's money to be made, and even more especially when there isn't.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#904
post #268

Earlier quoted context omitted.

I've checked, current Claude Code 2.1.87 uses Axios version is 1.14.0, just one before the compromised 1.14.1 To stop Claude Code from auto-updating, add `export DISABLE_AUTOUPDATER=1` to your global environment variables (~/.bashrc, ~/.zshrc, or such), restart all sessions and check that it works with `claude doctor`, it should show `Auto-updates: disabled (DISABLE_AUTOUPDATER set)`

This is good info, thanks. Can I ask how you detected that version of axios? I checked the source (from another comment) and the package.json dependencies are empty....

The source repo doesn't have a package.json, so I extracted the version directly from the binary (~/.local/share/claude/versions/2.1.87)

Axios sets a VERSION constant that it uses in user-agent headers, boundaries and errors. I scanned the binary for all references like axios, isAxiosError and AxiosError - the code references the same variable namespace (X1H, Tj, eq), suggesting a single bundled copy. In the minified bundle, that VERSION constant was stored in a variable called X1H. Searching the binary for all references to X1H confirms it's only used in axios contexts:

  var X1H="1.13.6"
  E.set("User-Agent","axios/"+X1H, ...)
  {tag:`axios-${X1H}-boundary`, ...}
  "[Axios v"+X1H+"] Transitional option ..."
  Tj.VERSION=X1H; Tj.AxiosError=eq; Tj.CancelToken=...
The bundled version is 1.13.6 - well before the compromised 1.14.1. I also checked that "1.14.1", "plain-crypto", and "sfrclak.com" are all absent from the binary.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#905

Earlier quoted context omitted.

To me, this is a sign of just how much regular people do not want AI. This is worse than crypto and metaverse before it. Crypto, people could ignore and the dumb ape pictures helped you figure out who to avoid. Metaverse, some folks even still enjoyed VR and AR without the digital real estate bullshit. And neither got shoved down your throat in everyday, mundane things like writing a paper in Word or trying to deal w…

It's how people resisted CGI back in the day. What people dislike is low quality. There is a loud subset who are really against it on principle like we also have people who insist on analog music but regular people are much more practical but they don't post about this all day on the internet.

No, I don't think most people are really against AI Gen works "on principle". Or at least not in any interpretation of "on principle" that would allow for you to be dismissive of complaints in this way.

I think principles are important. Especially when it comes to art, principle might be all we have. Going back to the crypto example, NFTs were art that real people had made. In some cases, very good art. People railed against NFTs despite the quality of the art. That is being against something on-principle. Comparatively, if my local grocery chains were owned by neonazis, I'd have a much harder time of standing on principle, giving that doing so may have a negative impact on my ability to survive and prosper.

AI Gen works, on the other hand, most often do not come with readily available marking that it is AI Gen. What people are complaining about is the lack of quality in the work. If they accuse a poorly human-written article of being AI Gen, that's just a mistake. But the general case is a legitimate evaluation of the quality of the material and the conditions under which it was made and presented.

In my own case, while I certainly have plenty of "principled" reasons to dislike AI Gen works, I also dislike it because it's just garbage. Oh yeah, sure, it's impressive that a computer can spit out reasonable content at all. It would equally be impressive for a chimpanzee to start talking in full sentences. That doesn't mean I'm going to start going to the chimpanzee for dissertations on the human condition.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#906
post #553
post #82

Earlier quoted context omitted.

https://github.com/instructkr/claude-code this one has more stars and more popular

I don't understand how you can have a 'clean-room port.' Seems contradictory to me.

That's not the actual plan.

"I have a popular repo, but the content will likely be removed and I won't have personally gained from the saga: how can I fix the part where I didn't profit?"

"Eureka! I'll remove the content preemptively, then come up with a backstory that justifies reusing the now empty repo for building the umpteenth coding harness! And I can even claim fuzzy ties to Claude Code!"

Hence the new description:

> The fastest repo in history to surpass 50K stars , reaching the milestone in just 2 hours after publication. Better Harness Tools, not merely storing the archive of leaked Claude Code but also make real things done. Now rewriting in Rust.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#908

Earlier quoted context omitted.

I guess I could just curl up into fetal position and watch the world go by. But that's no fun. Why not dream big and shoot for the moon with kooky goals like, say, having an underground, community-supported internet where things are falling less to shit? Belief in inevitability is a choice (except for maybe dying, I guess).

Why stop at one? Make more such underground community supported internets. The more the merrier. Monoculture ends with death. The only question is how long it will take.

Amen brother, this one will be for me and all my homies.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#910
post #863

Earlier quoted context omitted.

bc I build stuff like this myself - it doesn’t take anything to build a wrapper client around a good llm, including using another llm.

So .. the stuff you build yourself, you point it to claude then it runs just as productive as Claude CLI? Did you try?

Yes
Post reply on HN