Repository navigation
RP1 npx pattern matches across line breaks, so a line ending in "npx" plus the next word becomes a command #639
Description
Activity
I opened #646 to address this. The RP1 npx matcher now requires a word boundary and uses spaces/tabs instead of \s, so it cannot combine text across line breaks. Added regressions for the frontmatter and wrapped-prose false positives, identifier suffixes, and normal npx -y commands. The focused MCP rug-pull tests pass (31); hosted test-unit and docker-smoke checks are still running.
PR-state snapshot checked on 2026-10-04:
- PR #646 — open, non-draft; GitHub review decision: changes requested; latest reported check rollup: success.
Keeping this issue open: the relevant implementation is not merged. Check/review status is a point-in-time snapshot, not a claim of merge readiness.
_RP1_NPX_CMD(mcp_rug_pull.py:124-125) isnpx\s+..., and\smatches newlines. Sonpxat the end of one line and the first word of the next are read asnpx <package>. There is also no word boundary beforenpx.Minimal repro: a skill whose frontmatter is
produces an RP1 finding for
npx description(SARIF message:MCP server referenced without pinned version: 'npx\ndescription'). The same happens in wrapped prose, e.g. a line ending "...install it with npx" followed by a line starting "the ...".Suggested fix:
\bnpx[ \t]+(?:-+\w+[ \t]+)*..., keeping the match on one line. Happy to send a PR.