Hacker News Reader

That evidently didn't happen here.

I do remember reading about that too though, maybe it missed it because it was JSON data not a variable definition or something?

I can't find anywhere that specifies the actual pattern though.

it wasn't stored on GitHub.

there's a json file on GitHub referencing the download of the source archive, stored on pypi infra.

in the tgz you can download from pypi you can find python code containing the secret.