3 ms·
This advisory is pointing to the stylus package https://github.com/advisories/GHSA-fh4q-jc76-r59p https://github.com/advisories/GHSA-fh4q-jc76-r59p I'm still
by maury91 1y ago
This advisory is pointing to the stylus package
https://github.com/advisories/GHSA-fh4q-jc76-r59p https://github.com/advisories/GHSA-fh4q-jc76-r59p
I'm still unsure if it's a mistake on NPM side or if stylus and the authors are compromised
- clncy 1y agoIt's so hard to triage this when no justification has been provided for the advisory. Was the GHSA released in response to npm pulling the package, or vice versa? Many suggestions for workarounds, but if the GHSA is indeed accurate (all versions affected) then that seems unwise.
- maury91 1y agoAlso if all the versions are affected this malware is in stylus since 2010. Honestly, it sounds improbable to me that a malware exists unnoticed in open source software for 15 years. However, even if improbable it's better to play safe and just override the installation of stylus ( especially if you are not using it ) with an empty package until more information is released
- clncy 1y agoI agree that it seems very improbable. The only possible malicious scenario I can imagine is that the Github repo is clean, but npm creds have been compromised.
- wut42 1y agoThe package was pulled at: 2025-07-23T03:03:01.239Z And the GHSA advisory: 2025-07-23T03:03:56Z So the GHSA was released after the pull (by a minute).