Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

961–970 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#961
post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

wondering how this fares for languages other than English.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#962
post #858

Earlier quoted context omitted.

No it isn't. It's a competition, making moves that benefit you and attempting to deprive your opponent of the same move is just called competing

It's definitely still hypocrisy.

No it isn't, have you never played any game or sport? do you fundamentally not understand the concept of competition?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#963

Earlier quoted context omitted.

It doesn't matter that much. Trust me you could just have an LLM reverse engineer the obfuscated code.

The point is that a "secure coding platform" leaked something they were trying to keep under wraps, whether the contents of the leak matter or not. Also, as many others have pointed out, there is roadmap info in here that wouldn't be available in the production build.

No reasonable person actually thinks that Claude Code cannot make mistakes. So if your point is that this is going to change anybody's opinion about it then I think that's pretty silly.

Also who really cares about the roadmap? Any feature they release can be easily copied quickly. The only moat they have at the moment is in giving access to their models via a subscription.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#964
post #69

ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently slip decoy tool definitions into the model's system prompt. The goal: if someone is scraping Claude Code's API traffic to train a competing model, the poisoned training data makes that distillation attempt less…

This made me think of something - at work, if we wfh, we have to use one of those MITM proxies that intercept HTTPS at the kernel level. Imo such a thing can easily read the traffic and thus is indistinguishable from a distillation attempt from CC's PoV. I've had CC freak out on my machine, and sometimes generate pretty bad results, the CoT is often also not available.

I wonder it CC thinks I'm trying to distill the model. This is a common enough use case that I think the devs at Anthropic should consider.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#965
post #589
post #575

Earlier quoted context omitted.

Did you also forget to ignore case sensitivity back then?

the string is lowercased before the regex is run, fwiw

Smart, that way they will never know when you're shouting at them.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#966

Earlier quoted context omitted.

what does that even do?

Looks like it tries wl-copy, then tries xclip and then tries xsel. I have no idea what those are but google says it's for Wayland, so, I think it's a linux function trying to copy to clipboard? I think their problem is with the use of '.then(...=>...)' since there doesn't seem to be a way to tell each function that the nested ones actually finished.

wl-copy is a program to put text into the system clipboard if you're on a wayland-based system (so you can ctrl-v paste it somewhere else). Imagine like, cat ~/.ssh/whatever | wl-copy and then pasting into github or something.

xclip is the same for X based systems.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#967
post #7

The big loss for Anthropic here is how it reveals their product roadmap via feature flags. A big one is their unreleased "assistant mode" with code name kairos. Just point your agent at this codebase and ask it to find things and you'll find a whole treasure trove of info. Edit: some other interesting unreleased/hidden features - The Buddy System: Tamagotchi-style companion creature system with ASCII art sprites - Un…

[dead]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#968

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

How is it that a AI coding agent that is supposedly _so great at coding_ is running on this kind of slop behind the scenes. /s

Because in reality no one except for good engineers actually care about what the code looks like. The only thing most users care about with Claude Code is having it quickly vibe code the crappy idea they came up with that is going to 10x their lives, or whatever.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#969
post #661

Earlier quoted context omitted.

(I mostly agree with you, but) devils advocate: most people already do that with dependencies, so why not move the line even further up?

Because you trust that your dependencies are not vibe coded and have been reviewed by humans.

Stop trusting any dependency now.
Post reply on HN