xlsx

SheetJS Spreadsheet data parser and writer

Latest 0.18.5

NPM

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is recorded, so consumers have less independently verifiable evidence about how this release was produced.

Maintainers

Only one registry account, sheetjs, has publish access. The SheetJS organization repository provides some compensation, but the registry publishing base remains narrow.

Release history

The package has 171 releases over nearly 13 years, but its latest registry release was March 24, 2022, with no releases in the last 12 months. The long history shows maturity, while the multi-year release gap raises abandonment risk.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, though the older project history and organization backing provide some context.

Repo issue activity

Only one new issue and no closed issues or merged pull requests were recorded in the last month, indicating limited recent maintenance activity.

Vulnerabilities

Title	Versions	Severity
CVE-2024-22363 xlsx is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.0 - 0.20.2.	0.0.0 - 0.20.2	High
CVE-2023-30533 xlsx is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 0.19.3.	0.0.0 - 0.19.3	High
CVE-2021-32012 xlsx is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 0.17.0.	0.0.0 - 0.17.0	Medium
CVE-2021-32013 xlsx is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 0.17.0.	0.0.0 - 0.17.0	Medium
CVE-2021-32014 xlsx is vulnerable to Insufficient Verification of Data Authenticity in versions 0.0.0 - 0.17.0.	0.0.0 - 0.17.0	Medium