npm install fails due to missing stylus@0.54.8 (Angular 12)

[kbalu-edvak]

Which @angular/* package(s) are the source of the bug?

Don't known / other

Is this a regression?

Yes

Description

When running npm install on an Angular 12 project, the installation fails due to a dependency resolution error for stylus@0.54.8. The package version 0.54.8 does not exist on the npm registry, yet it is being requested as a peer dependency by stylus-loader@6.1.0, which is itself required by @angular-devkit/build-angular@12.2.18.

This breaks the installation flow for any project relying on Angular 12 with default tooling.

Please investigate and update any incorrect references to the nonexistent 0.54.8 version, or provide guidance on compatibility.

Please provide a link to a minimal reproduction of the bug

No response

Please provide the exception or error you saw

npm WARN peer stylus@">=0.52.4" from stylus-loader@6.1.0
npm WARN node_modules/stylus-loader
npm WARN   stylus-loader@"6.1.0" from @angular-devkit/build-angular@12.2.18
npm WARN   node_modules/@angular-devkit/build-angular

npm ERR! code ETARGET
npm ERR! notarget No matching version found for stylus@0.54.8.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/kishore/.npm/_logs/2025-07-23T05_46_09_434Z-debug-0.log

Please provide the environment you discovered this bug in (run ng version)

Angular CLI: 12.2.18
Node: 16.16.0 (Unsupported)
Package Manager: npm 8.11.0
OS: linux x64

Angular: <error>
... animations, cdk, common, compiler, compiler-cli, core
... flex-layout, forms, localize, material, platform-browser
... platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1202.18 (cli-only)
@angular-devkit/build-angular   <error>
@angular-devkit/core            12.2.18 (cli-only)
@angular-devkit/schematics      12.2.18 (cli-only)
@angular/cli                    12.2.18 (cli-only)
@schematics/angular             12.2.18 (cli-only)
rxjs                            6.6.7 (cli-only)
typescript                      5.8.3 (cli-only)

Anything else?

No response

[raeffs]

the package was removed from npm, see stylus/stylus#2938

[JoostK]

Angular 12 has not been supported for several years.

npm WARN peer stylus@">=0.52.4" from stylus-loader@6.1.0
npm WARN node_modules/stylus-loader
npm WARN stylus-loader@"6.1.0" from @angular-devkit/build-angular@12.2.18
npm WARN node_modules/@angular-devkit/build-angular

This indicates that stylus-loader wants styles >=0.52.4 and your package manager choose v0.54.8 for it; that should then subsequently be available for download.

---

Hello, we reviewed this issue and determined that it doesn't fall into the bug report or feature request category. This issue tracker is not suitable for support requests, please repost your issue on StackOverflow using tag angular.

If you are wondering why we don't resolve support issues via the issue tracker, please check out this explanation.

[Exac]

@JoostK This affects the current version of Angular too, as stylus is a dependency of vite, which is a dependency of @angular/build.

[JeanMeche]

There has been a supply chain attain on multiple packages recently : https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise

It looks like there is an issue we stylus right now with only 0.0.1 available : https://www.npmjs.com/package/stylus?activeTab=versions

See the upstream vite issue :

• Stylus package was removed by npm for malicious code vitejs/vite#20461