// Source control / registries
pattern: reads-pypirc
Packages that read .pypirc or TWINE_PASSWORD environment variables. Direct path to PyPI account takeover and downstream malicious version publishing.
3 packages flagged with this pattern (5 total publish events, collapsed by publisher+name). Newest first.
Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.
AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,
EPyT: An EPANET-Python Toolkit for Smart Water Network Simulations. The EPyT is inspired by the EPANET-Matlab Toolkit.
→ Credential read (reads-pypirc) paired with http-to-public-ip destination — classic exfiltration signature.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.
