Episode 139

Claude Code's Secrets Are Out

Well... that wasn't supposed to happen 😬. Anthropic accidentally exposed Claude Code internals via npm, Axios gets compromised with a self-deleting RAT 🚨, and RedwoodSDK 1.0 goes all-in on Cloudflare.

Full Description

This week, Anthropic accidentally leaked Claude Code's source code to the world when it published a source map inside an npm release pointing to the repos that house Claude's prompts, tools, logic, and so on. While the offending file was quickly removed, the code was out there and folks got to work speculating about what's coming next for Claude Code. Always running background daemons, something known as "undercover mode", and a cute little ASCII animal next to users inputs are some of the things we might see in Claude's future. The npm hacks keep on coming as well, as popular data fetching library Axios is the latest victim. This particular hack delivered a remote access trojan (RAT) virus courtesy of a postinstall script, that deleted itself after execution to evade detection. Sneaky! Lock down your packages and dependencies, folks. And in Lightning News this week, RedwoodSDK debuted its 1.0 version. Redwood's going all in on Cloudflare with full integration for workers, queues, AI, and more, and offers a server-first React SDK with RSC out of the box and "no hidden magic" like other React metaframeworks.