
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
airo-models
Advanced tools
Curated URDFs and 3D models of the robots and gripper used at airo.
airo-models is available on PyPi and can be installed with pip:
pip install airo-models
Example of loading a URDF from airo-models, customizing it and writing it to a temporary file:
import airo_models
robotiq_urdf_path = airo_models.get_urdf_path("robotiq_2f_85")
robotiq_urdf = airo_models.urdf.read_urdf(robotiq_urdf_path)
# Make the robotiq gripper static
airo_models.urdf.replace_value(robotiq_urdf, "@type", "revolute", "fixed")
airo_models.urdf.delete_key(robotiq_urdf, "mimic")
airo_models.urdf.delete_key(robotiq_urdf, "transmission")
# Write it to a temporary file to read later with Drake's AddModelFromFile
robotiq_static_urdf_path = airo_models.urdf.write_urdf_to_tempfile(
robotiq_urdf, robotiq_urdf_path, prefix="robotiq_2f_85_static_"
)
To check which models are available:
from airo_models.files import AIRO_MODEL_NAMES
print(AIRO_MODEL_NAMES)
>>> ['ur3e', 'ur5e', 'robotiq_2f_85']
The standard convention we follow is X+ forward, Z+ up.
For cameras, we follow Z+ forward through the eye of the camera, X+ right. The origin of the camera is at the center of the (left) lens. Left is defined egocentric of the camera (i.e. looking out of the eyes of the camera).
For grippers, we follow Z+ pointing outwards from the fingers and X in the direction in which the parallel gripper closes its fingers. The origin of the gripper (base_link) is at the mounting point of its base.
uv syncuv run pre-commit installuv run pytest .Releasing to PyPi is done automatically by github actions when a new tag is pushed to the main branch.
pyproject.toml. git add pyproject.toml git commit -m "" git pushgit tag -a v0.1.0 -m "airo-models v0.1.0"git push origin v0.1.0This was set up following this guide first and then this guide.
FAQs
Curated URDFs and 3D models of the robots and gripper used at airo.
We found that airo-models demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.