[borplk]

Does anyone know what the malicious code was and what it did?

[dale_lakes]

The malicious code had nothing to do with the stylus package. One of the maintainers of stylus published malicious code in another package, and GitHub / npmjs response was to nuke ALL packages that he was a maintainer of, including stylus.

[silverwind]

The sensible action would be to remove only the malicious packages and suspend that account.