Is Claude Code's outputted code also part of the supply chain risk?