PyPI · pypi.org

latch

Credential File Packaged: latch-2.76.0/src/latch_cli/services/init/assemble_and_sort/.env

Why PkgRadar flagged 2.76.0

Severity	Signal	Evidence
high	Credential File Packaged	latch-2.76.0/src/latch_cli/services/init/assemble_and_sort/.env · latch-2.76.0/src/latch_cli/services/init/assemble_and_sort/.env
medium	Py Import Time Subprocess	subprocess call — process spawning. · latch-2.76.0/src/latch_cli/utils/__init__.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`2.76.0`	High risk	48	2026-06-05
`2.75.0`	High risk	48	2026-06-05

Block this in CI

PkgRadar gates latch (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi latch==2.76.0