My workaround: Add this on your package.json on the end of file bevor last }: },... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

kontercola on July 23, 2025 | parent | context | favorite | on: NPM stylus package contained malicious code and wa...

My workaround:

Add this on your package.json on the end of file bevor last }:

  },
  "overrides": {
    "stylus": "0.0.1-security"
  }

dale_lakes on July 23, 2025 | [–]

Random internet person: Do not do this ^ . Wait for the package to be restored by npmjs, or use the workaround in the pinned issue on the stylus repo.

okcdz on July 23, 2025 | [–]

It seems this doesn't work. The package is empty, it can't function. It makes the world stop, which is terrible!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact