@univerjs/sheets

Core spreadsheet model and business logic for Univer Sheets.

Latest 1.0.4

NPM

94%

Total Score

healthy

Active, organization-backed project with strong release activity and provenance; all 21 workflow actions are unpinned.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 8 workflows were analyzed with no failed files, dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 21 action references are unpinned and two workflows grant top-level write permissions, creating a workflow supply-chain hygiene concern without an observed untrusted sink.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10796 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @univerjs/sheets is vulnerable to Incorrect Authorization in versions 0.5.4 - 0.20.1.	0.5.4 - 0.20.1	High

Package versions

Maintainers

jikkai

wbfsa

mengshukeji

Direct Dependencies

Dependency	Last Release	Score
@univerjs/rpc Version 1.0.4	—	—
@univerjs/core Version 1.0.4	—	—
@univerjs/protocol Version 1.0.4	—	—
@univerjs/engine-render Version 1.0.4	—	—
@univerjs/engine-formula Version 1.0.4	—	—