NPM stylus package contained malicious code and was removed from the registry

Re:NPM stylus package contained malicious code and was remov... by clncy on Wednesday July 23, 2025 @03:50AM (#44656738)

It's so hard to triage this when no justification has been provided for the advisory. Was the GHSA released in response to npm pulling the package, or vice versa?

Many suggestions for workarounds, but if the GHSA is indeed accurate (all versions affected) then that seems unwise.

[ Parent | on HN ]

Re:NPM stylus package contained malicious code and was remov... by wut42 on Wednesday July 23, 2025 @04:14AM (#44656864)

The package was pulled at: 2025-07-23T03:03:01.239Z

And the GHSA advisory: 2025-07-23T03:03:56Z

So the GHSA was released after the pull (by a minute).

[ Parent | on HN ]

Re:NPM stylus package contained malicious code and was remov... by maury91 on Wednesday July 23, 2025 @03:59AM (#44656788)

Also if all the versions are affected this malware is in stylus since 2010. Honestly, it sounds improbable to me that a malware exists unnoticed in open source software for 15 years. However, even if improbable it's better to play safe and just override the installation of stylus ( especially if you are not using it ) with an empty package until more information is released

[ Parent | on HN ]

Re:NPM stylus package contained malicious code and was remov... by clncy on Wednesday July 23, 2025 @04:14AM (#44656862)

I agree that it seems very improbable. The only possible malicious scenario I can imagine is that the Github repo is clean, but npm creds have been compromised.

[ Parent | on HN ]