[Pinned] The stylus package is accessible on npm now !
# for [npmmirror.com](https://npmmirror.com) user https://github.com/cnpm/cnpmcore/issues/817 reply from npmmirror maintainer >昨天我们临时手动在 npmmirror 上手动发布了对应版本，由于是二次发布会导致 hash 不一致。今天上午 10:43 分 我们对 stylus 重新同步，删除了昨天的临时版本。 重新生成一下 lock 文件看看是否恢复？🙏 # The stylus package is accessible on npm again <img width="700px" height="550" alt="Image" src="https://github.com/user-attachments/assets/b635a1a7-1396-44da-9538-52a653a83f0c" /> # Received a reply from GitHub official ```txt Hello, Thanks for taking the time to let us know. It appears a maintainer associated with the stylus package published a malicious package which resulted in the account being suspended and associated packages being removed. Our engineers are currently working on restoring stylus, we will update you when this has been completed. Please let us know if we can help in any other way. Regards, GitHub Trust & Safety ``` # Some personal thoughts: if your company has been affected by Stylus, you need to reevaluate the relationship between npmjs and npm mirror and design a more reliable development process. # Some conclusions * 1. Stylus does not contain malicious code; this has been confirmed. npmmirror.com (a non-profit mirror sponsored by Alibaba) has resumed access. * 2. It is unclear whether this is a coincidence, but a tool called Stylus Tools component has been reported to have a CVE. * 3. Panya (the former maintainer of Stylus) used their own account to release a package containing malicious code (
Posted by iChenLei on Jul 23, 2025, 4:17 AM
Tags
Related issues
- [Meta] Feedback on granular control over Copilot changes
- unexpected status 401 Unauthorized issue
- [MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
- [CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
- Video stops playing after some minutes
- [MODEL] Claude verbose code comments by default — ignores instructions to stop.
Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments
github (Software)
[Meta] Feedback on granular control over Copilot changes
unexpected status 401 Unauthorized issue
[MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
[CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
Video stops playing after some minutes
[MODEL] Claude verbose code comments by default — ignores instructions to stop.
Scope Codex VS Code chats to the current workspace/project
Update on "Co-authored-by: Copilot" in commit messages
[Pinned] The stylus package is accessible on npm now !
# for [npmmirror.com](https://npmmirror.com) user https://github.com/cnpm/cnpmcore/issues/817 reply from npmmirror maintainer >昨天我们临时手动在 npmmirror 上手动发布了对应版本，由于是二次发布会导致 hash 不一致。今天上午 10:43 分 我们对 stylus 重新同步，删除了昨天的临时版本。 重新生成一下 lock 文件看看是否恢复？🙏 # The stylus package is accessible on npm again <img width="700px" height="550" alt="Image" src="https://github.com/user-attachments/assets/b635a1a7-1396-44da-9538-52a653a83f0c" /> # Received a reply from GitHub official ```txt Hello, Thanks for taking the time to let us know. It appears a maintainer associated with the stylus package published a malicious package which resulted in the account being suspended and associated packages being removed. Our engineers are currently working on restoring stylus, we will update you when this has been completed. Please let us know if we can help in any other way. Regards, GitHub Trust & Safety ``` # Some personal thoughts: if your company has been affected by Stylus, you need to reevaluate the relationship between npmjs and npm mirror and design a more reliable development process. # Some conclusions * 1. Stylus does not contain malicious code; this has been confirmed. npmmirror.com (a non-profit mirror sponsored by Alibaba) has resumed access. * 2. It is unclear whether this is a coincidence, but a tool called Stylus Tools component has been reported to have a CVE. * 3. Panya (the former maintainer of Stylus) used their own account to release a package containing malicious code (
Comments (0)
No comments yet. Start the discussion.