nirholas/fresh-start: what remains of the claude-code mirror after the DMCA

What nirholas/fresh-start is, and what it is not

This repository is the same GitHub object that used to be nirholas/claude-code, described in its own README as "the most widely forked mirror of the Claude Code source leak of 31 March 2026." Because the repository was renamed rather than deleted, github.com/nirholas/claude-code still redirects here. Anyone following an old link lands on a page with three top-level entries: HISTORY.md, LICENSE and README.md.

The README is blunt about the state of the tree: "It contains no Anthropic source code, and it will not." The contents were removed after Anthropic's DMCA notice, and the README states that the notice has not been retracted. So the repository is not a mirror anymore and not a fork in any useful sense. It is a placeholder with a written record attached.

The audience is narrow. People who cloned the mirror before the takedown, people who downloaded one of the many copies that circulated in April 2026, and people who read a writeup claiming Claude Code shipped a cryptocurrency wallet. Everyone else has no reason to be here.

The x402 correction the repository exists to make

The substantive claim in the README concerns payment code. According to the project, Claude Code has never contained a cryptocurrency wallet or an autonomous payment system. The x402 payment code that circulated alongside copies of the leak was written by the repository owner, on top of the leaked tree, while building a separate project. It was not Anthropic's code and it was not part of the leak.

The README says several popular writeups still describe that code as an undocumented Anthropic feature, which is why the correction is still being made. HISTORY.md is presented as the full record: what leaked and how, what the DMCA did and did not cover, and the correction itself. The README states that HISTORY.md shows three independent ways to verify that x402 was not in the original tree and gives a complete accounting of every file the author changed.

That accounting is the interesting part for anyone doing verification work. A file-by-file list is falsifiable in a way that a denial is not. The repository does not ask you to take its word for it, and the README supplies a test instead.

Checking a leaked copy with grep -r x402 src/

The README gives one command as the test for a copy of the leak you already hold. Run it from the root of that copy, not from this repository, which no longer contains a src directory.

grep -r x402 src/

The claim is that this search distinguishes the original leaked tree from a copy that has the author's payment code mixed into it. If the command returns matches, the copy you are holding is not a clean version of the leak. If it returns nothing, that particular test does not implicate the copy, though it says nothing about whether the copy is otherwise safe to run.

The README does not publish the expected output, does not name the files the author added, and does not say which of the three verification methods in HISTORY.md this command represents. That is a gap. A reader who wants the file list has to open HISTORY.md, and the README does not summarise what the other two verification methods are. Treat the command as a starting point and the history file as the actual evidence.

Why installing dependencies from any copy of the leak is dangerous

The README makes a security argument that has nothing to do with the DMCA. The leaked tree imports internal packages that do not exist on the public npm registry. Squatters publish malicious packages under exactly those names. The consequence, as stated, is that installing dependencies from any copy of this codebase can execute arbitrary code on your machine.

This is a supply chain problem created by the leak itself, not by the mirror. A missing internal package is an open name on a public registry, and anyone can claim it. A package manager resolving that name does not know the difference between the internal original and a stranger's upload.

The README also points to genuinely trojanized "Claude Code leak" repositories in circulation in April 2026, documented by Zscaler ThreatLabz, which it says distributed Vidar and GhostSocks through a Windows executable. The advice that follows is direct: use the official Claude Code CLI from Anthropic. There is no install section in this repository because there is nothing here to install.

Where fresh-start is the wrong tool

If you came looking for a self-hosted Claude Code, a mirror to fork, or a source tree to study, this repository cannot help you and the README says so. The code is gone and the README states it will not return. There is no package on npm, no release, no build, no configuration file and no CLI in the three files at the top level.

It is also the wrong source for a neutral account of the leak. The repository owner is a participant: he added code to the tree, and he is now correcting the record about that code. The README describes HISTORY.md as the full record, but the record is written by the person whose changes are in question. For an independent account of the malware side, the README points to Zscaler ThreatLabz. For the legal side, the DMCA notice itself is the document that matters, and the README only reports that it has not been retracted.

Finally, the repository is a poor fit for anyone who needs a stable citation. The default branch is named clean-start, and the README describes a state that is explicitly temporary in spirit: the description says the project will return once everything is cleared, and that the author is working with Anthropic and GitHub to get it back. A record that may be rewritten is a weak foundation for a report.

Alternatives and how they differ

The README's own recommendation is the official Claude Code CLI from Anthropic. That is the real alternative, and the difference is not subtle: it is the maintained product, distributed by the vendor, and it does not carry the missing-internal-package problem because its dependency graph is the vendor's. Anyone who wanted Claude Code in the first place should use it.

If your goal is auditing a leaked copy rather than running Claude Code, the alternative is HISTORY.md in this same repository. The README frames the two as different jobs: the README states the short version of the correction, and HISTORY.md carries the full record with three verification methods and a complete accounting of changed files. Reading only the README leaves you with a claim; reading the history file gives you the file list.

If your goal is understanding the malware campaign, the Zscaler ThreatLabz writeup cited in the README is the independent source, and it covers a different subject: trojanized repositories distributing Vidar and GhostSocks, not the provenance of the x402 code.

Licence, maintenance and what the repository costs you

The README ends with a licence section: all rights reserved, with a pointer to the LICENSE file. That is not an open source licence, and it is not the permissive arrangement the original mirrored code would have carried. For a repository whose only content is documentation, the practical effect is that you should not expect to reuse the text or the history file under an open licence. This is a description of what the files say, not legal advice; read LICENSE yourself before republishing anything from here.

The GitHub metadata records no retrieved releases, and the repository was last pushed on 2026-09-15, one week before this writing. It is not archived. The README describes an in-progress situation rather than a finished one: the description says the project will return once everything is cleared.

Upgrade cost is therefore not the usual kind. There is no version to bump and no migration path to plan. The cost is attention: if you cite this repository, you are citing a page whose owner expects it to change, and whose central document, HISTORY.md, is the thing you should actually read.

Editorial conclusion

Adopt nothing here as a code dependency; the repository is a record, not a package. Read it if you are auditing a leaked copy you already hold, or if you need the project's own account of the x402 payment code that was added on top of the leak. Do not clone it expecting a working Claude Code tree, and do not install dependencies from any copy of the leak, because the README states those internal package names are targeted by squatters on the public npm registry. Verify the x402 claim yourself with grep -r x402 src/ against whatever copy you have, then compare it with the file-by-file accounting in HISTORY.md.

Frequently asked questions

Official sources

1. Issues
2. nirholas/fresh-start on GitHub
3. README