This advisory has been withdrawn because the stylus npm package is not malware.