forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-16 09:26:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

npx_confusion: drop tooling identifier from registry control lookup

Browse Source
This commit is contained in:
Alex Schapiro
2026-08-12 12:54:39 +00:00
parent f1a17435d1
commit 1aee9e38f2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
strix/skills/custom/npx_confusion.md
+1 -1
View File
@@ -162,7 +162,7 @@ Before trusting any of those states, check whether the target's lookup path can
# Public npm example; use a known package from the actual registry when different.
task_registry="$(npm config get registry)"
npm view --registry="$task_registry" lodash name --json
npm view --registry="$task_registry" "strix-control-$(openssl rand -hex 12)" name --json
npm view --registry="$task_registry" "$(openssl rand -hex 12)" name --json
```
Run the pair through the same `.npmrc`, scope routing, authentication, proxy, and egress path as the candidate. Direct `curl` requests to the public registry are a separate observation unless the target runner uses that exact route. A successful pair establishes coarse positive/negative discrimination, not authenticity of every candidate response; verify that returned documents name the requested package and contain plausible registry metadata.