Stylus contained malicious code and was removed from the registry by the npm security team

[studds]

Describe the bug

Can't install as stylus has been removed from npm registry.

To Reproduce
Steps to reproduce the behavior:

1. npm I typescript-plugin-css-modules

npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/stylus/-/stylus-0.62.0.tgz - Not found

Expected behavior

Able to install

Additional context
Add any other context about the problem here.

[pastak]

I decided to move to css-modules-kit to avoid this.

[varunaswal]

It's possible this was done by mistake - there's a relevant issue on the stylus repo

[naniylid]

Please update stylus version "stylus": "^0.0.1-security",

[Sansith]

Effected by this since typescript-plugin-css-modules is using stylus was removed from the NPM and YARN registries. Pipelines are failing.

Any workaround for this ?

[mrmckeb]

It looks like this might have been a mistake:
stylus/stylus#2938

I'll take a look at this tonight, hopefully in the next 2-3 hours, and try to release a patched version.

In the meantime, you should be able to use your package manager to override the package to the 0.0.1-security release.

• https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides
• https://pnpm.io/package_json#pnpmoverrides
• https://yarnpkg.com/configuration/manifest#resolutions

For example, for pnpm it would be:

{
  "pnpm": {
    "overrides": {
      "stylus": "0.0.1-security",
    }
  }
}

Please report back if this does/doesn't help as a workaround.

[wanjas]

@Sansith

Effected by this since typescript-plugin-css-modules is using stylus was removed from the NPM and YARN registries. Pipelines are failing.

Any workaround for this ?

In this comment, several options for a workaround are presented.
stylus/stylus#2938 (comment)

[mrmckeb]

Publishing a small update now, which makes Stylus an optional dependency - meaning that the install will continue if it fails.
https://docs.npmjs.com/cli/v11/configuring-npm/package-json#optionaldependencies

[mrmckeb]

v5.2.0 is now published.

I've tried to include nothing else in this release apart from two Dependabot security updates.

Please let me know if you hit any issues with this release.

[edhgoose]

Thanks for jumping on this so quickly @mrmckeb!

We're still having challenges with Yarn because it looks like it behaves differently to npm. If an optional package fails to install the package will not be installed either.

The relevant docs appear to be:

https://yarnpkg.com/configuration/manifest#optionalDependencies:~:text=Note%20that%20optionalDependencies%20only%20cares%20about%20whether%20the%20package%20should%20install/build%20or%20not%20%2D%20it%20should%20still%20be%20resolvable%2C%20as%20otherwise%20it%27s%20impossible%20to%20tell%20whether%20a%20failure%20to%20retrieve%20the%20package%20metadata%20is%20intentional%20or%20not.

Note that optionalDependencies only cares about whether the package should install/build or not - it should still be resolvable, as otherwise it's impossible to tell whether a failure to retrieve the package metadata is intentional or not.

[mrmckeb]

Thanks @edhgoose, is resolutions a satisfactory workaround for you right now?

I'd like to wait to see what npm does before fully removing Stylus - but if you have no viable workarounds, please let me know ASAP.