stylus
Robust, expressive, and feature-rich CSS superset
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from tjholowaychuk to kizu occurred in 2013 — a historical, legitimate maintainer transition. kizu has 111 approved packages and 4679 days of ecosystem history. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): kizu was added as maintainer in 2013 as part of a legitimate transition; long-standing trusted contributor with strong track record. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in lib/functions/use.js is the documented Stylus @use plugin-loading mechanism — intentional and expected for this CSS preprocessor. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in lib/nodes/function.js is used for AST function node cloning in the Stylus language runtime — standard pattern for parsers/template engines. | ai | |
| provenance | no-provenance | AI (provenance): Stylus is an established open-source project; lack of Sigstore provenance is common and not a disqualifier here. | ai |
Versions (showing 51 of 168)
| Version | Deps | Published |
|---|---|---|
| 0.64.0 | 5 / 2 | |
| 0.63.0 | 5 / 2 | |
| 0.62.0 | 5 / 2 | |
| 0.61.0 | 5 / 2 | |
| 0.60.0 | 5 / 2 | |
| 0.59.0 | 5 / 2 | |
| 0.58.1 | 5 / 2 | |
| 0.58.0 | 5 / 2 | |
| 0.57.0 | 6 / 2 | |
| 0.56.0 | 6 / 3 | |
| 0.55.0 | 8 / 3 | |
| 0.54.8 | 8 / 3 | |
| 0.54.7 | 8 / 3 | |
| 0.54.6 | 8 / 3 | |
| 0.54.5 | 6 / 3 | |
| 0.54.4 | 6 / 3 | |
| 0.54.3 | 6 / 3 | |
| 0.54.2 | 6 / 3 | |
| 0.54.0 | 6 / 3 | |
| 0.53.0 | 6 / 3 | |
| 0.52.4 | 6 / 3 | |
| 0.52.3 | 6 / 3 | |
| 0.52.2 | 6 / 3 | |
| 0.52.1 | 6 / 3 | |
| 0.52.0 | 6 / 3 | |
| 0.51.1 | 6 / 3 | |
| 0.51.0 | 6 / 3 | |
| 0.50.0 | 6 / 3 | |
| 0.49.3 | 6 / 3 | |
| 0.49.2 | 6 / 3 | |
| 0.49.1 | 6 / 3 | |
| 0.49.0 | 6 / 3 | |
| 0.48.1 | 6 / 3 | |
| 0.48.0 | 6 / 3 | |
| 0.47.3 | 5 / 3 | |
| 0.47.2 | 5 / 3 | |
| 0.47.1 | 5 / 3 | |
| 0.47.0 | 5 / 3 | |
| 0.46.3 | 5 / 3 | |
| 0.46.2 | 5 / 3 | |
| 0.46.1 | 5 / 3 | |
| 0.46.0 | 5 / 3 | |
| 0.45.1 | 5 / 3 | |
| 0.45.0 | 5 / 3 | |
| 0.44.0 | 5 / 2 | |
| 0.43.1 | 5 / 2 | |
| 0.43.0 | 5 / 2 | |
| 0.42.3 | 5 / 2 | |
| 0.42.2 | 5 / 2 | |
| 0.42.1 | 5 / 2 | |
| 0.42.0 | 5 / 2 |
v0.63.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-05. This could indicate a legitimate maintainer transition or an account compromise.
v0.62.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-18. This could indicate a legitimate maintainer transition or an account compromise.
v0.61.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.60.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-30. This could indicate a legitimate maintainer transition or an account compromise.
v0.59.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-08-13. This could indicate a legitimate maintainer transition or an account compromise.
v0.58.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-31. This could indicate a legitimate maintainer transition or an account compromise.
v0.58.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-28. This could indicate a legitimate maintainer transition or an account compromise.
v0.57.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-02-19. This could indicate a legitimate maintainer transition or an account compromise.
v0.56.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-12-18. This could indicate a legitimate maintainer transition or an account compromise.
v0.55.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-09-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.8
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-07-16. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.7
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-08-21. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.6
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-08-20. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.5
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-27. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-27. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-26. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-03-11. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.53.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.51.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.51.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.50.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.48.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.45.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.45.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.44.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2014-04-23. This could indicate a legitimate maintainer transition or an account compromise.
v0.43.1
2 findingsThis version was published by a different npm account than previous versions on 2014-04-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.43.0
2 findingsThis version was published by a different npm account than previous versions on 2014-04-05. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.3
2 findingsThis version was published by a different npm account than previous versions on 2014-03-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.2
2 findingsThis version was published by a different npm account than previous versions on 2014-01-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.1
2 findingsThis version was published by a different npm account than previous versions on 2014-01-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.0
2 findingsThis version was published by a different npm account than previous versions on 2014-01-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.