From how is unfolding the most probable outcome is that one of the maintainer is compromised ( Ponya ), all of the packages he contributed to have been marked
NPM stylus package contained malicious code and was removed from the registry
11–20 of 45 posts
Re: NPM stylus package contained malicious code and was removed from the registry
#12From how is unfolding the most probable outcome is that one of the maintainer is compromised ( Ponya ), all of the packages he contributed to have been marked
That could track but people in the GitHub issue ( https://github.com/stylus/stylus/issues/2938#issuecomment-31... ) have found that no "other" version of Stylus has been released.
Re: NPM stylus package contained malicious code and was removed from the registry
#13From how is unfolding the most probable outcome is that one of the maintainer is compromised ( Ponya ), all of the packages he contributed to have been marked
That could track but people in the GitHub issue ( https://github.com/stylus/stylus/issues/2938#issuecomment-31... ) have found that no "other" version of Stylus has been released.
It may simply be Github and NPM going nuclear and just flagging everything just in case
Re: NPM stylus package contained malicious code and was removed from the registry
#14Earlier quoted context omitted.
That could track but people in the GitHub issue ( https://github.com/stylus/stylus/issues/2938#issuecomment-31... ) have found that no "other" version of Stylus has been released.
It may simply be Github and NPM going nuclear and just flagging everything just in case
Could be! Other comments (~~can't find them now as the issue got full of useless comments~~ e.g. https://github.com/stylus/stylus/issues/2938#issuecomment-31...) also noted that the GHSA bot have nuked a lot of other npm packages since days or weeks in the same fashion, so it could also be an AI scanner going full full nuclear.
Re: NPM stylus package contained malicious code and was removed from the registry
#15The title is wrong. There's no proof of compromise. There are no releases of the package since October. Apparently one of the long-time maintainers has pushed other compromised packages, so npm just nuked all the packages he had access to, whether they were compromised or not.
Re: NPM stylus package contained malicious code and was removed from the registry
#16Earlier quoted context omitted.
It may simply be Github and NPM going nuclear and just flagging everything just in case
Could be! Other comments (~~can't find them now as the issue got full of useless comments~~ e.g. https://github.com/stylus/stylus/issues/2938#issuecomment-31... ) also noted that the GHSA bot have nuked a lot of other npm packages since days or weeks in the same fashion, so it could also be an AI scanner going full full nuclear.
Agree it would be nice if people would stop posting "help! how can I fix this?" and "I fixed it by doing X", they were valid comments at the beginning, but now more than half of the comments are just these two
Re: NPM stylus package contained malicious code and was removed from the registry
#17Man I thought I was going crazy.
My staging build was failing and I saw that stylus was the culprit. Running `npm why stylus`, `npm ls --all stylus`, and other variants of these two commands consistently returned nothing, but I can see it in my lockfile if I run `grep -R stylus package-lock.json`.
Even running `npm audit | grep stylus` returned nothing! Which I think is pretty crazy considering the package itself has been overwritten by NPM to include a 0 context scary "Security holding package" thing. Surely this sort of thing should show up in the `audit` results?
Re: NPM stylus package contained malicious code and was removed from the registry
#18Removing the entire package is pretty unusual, normally it's only specific compromised versions.
The advisory says all the versions are affected ">= 0" https://github.com/advisories/GHSA-fh4q-jc76-r59p
Once again proof that advisories are full of etc.
Stylus has been around for 15 (FIFTEEN) years. Obviously the "vulnerability" is a lie.
Npm is known to cause huge losses of money for developers and companies around the world when they pull things like this, blindly applying advisories.
Re: NPM stylus package contained malicious code and was removed from the registry
#19My workaround:
Add this on your package.json on the end of file bevor last }:
},
"overrides": {
"stylus": "0.0.1-security"
}Re: NPM stylus package contained malicious code and was removed from the registry
#20Colleague of mine. Pointed out that github advisory had many new malware reports in last few days. All looking same.
Looks suspicious if you ask me. Maybe somebody hacked the github advisory db?