@stackline/xlsx

A maintained SheetJS-compatible spreadsheet parser and writer with Stackline security hardening for applications that need a practical replacement path for xlsx.

Documentation | npm | Issues | Repository

Current package version: 1.0.6

Why this package?

@stackline/xlsx is an independent maintained fork of SheetJS Community Edition 0.20.3. It keeps the familiar workbook API while adding regression coverage and hardening for known prototype pollution and ReDoS advisories.

The primary goal is compatibility with existing spreadsheet workflows, including Angular applications that currently depend on xlsx.

Compatibility

| Item | Value | | :--- | :--- | | Package | @stackline/[email protected] | | API target | [email protected] | | Runtime dependencies | none | | Supported Node.js | >=20 | | Types | types/index.d.ts | | Module entry | xlsx.mjs | | CommonJS entry | xlsx.js | | CLI | not published in the Stackline package line |

Installation

Use the scoped package for new integrations:

npm install @stackline/xlsx

Applications that must preserve existing imports can use npm alias migration:

npm install xlsx@npm:@stackline/xlsx

That keeps application code like this working:

import * as XLSX from 'xlsx';

Usage

Read a workbook

import * as XLSX from '@stackline/xlsx';

export function parseWorkbook(file: ArrayBuffer) {
  const workbook = XLSX.read(file, { type: 'array' });
  const sheetName = workbook.SheetNames[0];
  return XLSX.utils.sheet_to_json(workbook.Sheets[sheetName], {
    defval: null
  });
}

Create a workbook

import * as XLSX from '@stackline/xlsx';

const worksheet = XLSX.utils.json_to_sheet([
  { name: 'Ada', role: 'Engineer' },
  { name: 'Grace', role: 'Reviewer' }
]);

const workbook = XLSX.utils.book_new();
XLSX.utils.book_append_sheet(workbook, worksheet, 'People');

const output = XLSX.write(workbook, {
  type: 'array',
  bookType: 'xlsx'
});

CommonJS

const XLSX = require('@stackline/xlsx');

const workbook = XLSX.utils.book_new();
const worksheet = XLSX.utils.aoa_to_sheet([
  ['Name', 'Role'],
  ['Katherine', 'Analyst']
]);

XLSX.utils.book_append_sheet(workbook, worksheet, 'People');

Supported Formats

The fork keeps the upstream SheetJS Community Edition 0.20.3 format surface.

| Format family | Read | Write | Notes | | :--- | :---: | :---: | :--- | | XLSX / XLSM / XLSB | Yes | Yes | Modern Excel workbook formats | | XLS | Yes | Yes | Legacy Excel workbook format | | ODS / FODS | Yes | Yes | OpenDocument spreadsheet formats | | CSV / TSV / TXT | Yes | Yes | Plaintext tabular data | | HTML tables | Yes | Yes | Table import and export helpers | | DBF / SYLK / DIF | Yes | Yes | Legacy interchange formats |

Security Hardening

This release blocks or ignores dangerous object keys in parser and conversion paths:

• __proto__
• prototype
• constructor

The hardening covers worksheet names, XML attributes, relationships, custom properties, workbook parsing paths and JSON conversion helpers.

Regression tests cover:

• GHSA-4r6h-8v6p-xvw6 / CVE-2023-30533 prototype pollution
• GHSA-5pgg-2g8v-p4x9 / CVE-2024-22363 ReDoS
• malicious XLSX, ODS, XLS and XLML workbook structures
• dangerous relationship IDs
• dangerous custom property names
• JSON headers that try to pollute Object.prototype
• malformed HTML input that should not stall regex parsing
• hidden-row JSON streams that must always terminate

HTML generated from untrusted workbooks can restrict hyperlinks to relative URLs and common safe protocols without changing the default behavior:

const html = XLSX.utils.sheet_to_html(worksheet, {
  sanitizeLinks: true
});

API Surface

The public utility names are preserved for existing consumers.

The legacy any return declarations for writeFile, writeFileXLSX and writeFileAsync are preserved throughout the 1.x line for TypeScript source compatibility. These functions return undefined at runtime; applications should use them for their side effects rather than depend on a return value.

Release Metrics

The repository records the npm per-version last-week view once per UTC day. The history is stored in metrics/npm-version-downloads.json and is intended for adoption trends, not as a count of unique users.

Published 1.0.x versions remain available and supported under the security policy. Download share alone is not a reason to deprecate an older release; new installations should still use the unpinned command above to receive the maintained latest version.

| Utility | Purpose | | :--- | :--- | | XLSX.read | Parse workbook data from buffers, strings and binary inputs | | XLSX.write | Serialize workbooks to supported output formats | | XLSX.writeFile | Write workbook files in Node.js environments | | XLSX.utils.sheet_to_json | Convert a worksheet to row objects | | XLSX.utils.json_to_sheet | Convert row objects to a worksheet | | XLSX.utils.aoa_to_sheet | Convert arrays of arrays to a worksheet | | XLSX.utils.book_new | Create an empty workbook | | XLSX.utils.book_append_sheet | Append worksheets to a workbook |

Local Development

git clone https://github.com/alexandroit/sheetjs.git
cd sheetjs
npm ci

Run the security regression tests:

npx mocha -R spec -t 10000 test.js -g "security regressions"

Run the full suite:

npm test

Build and verify the package:

npm run build
PATH="$PWD/node_modules/.bin:$PATH" make dist
npm pack --dry-run

Consumer Smoke Test

The repository includes a Verdaccio consumer fixture:

cd examples/verdaccio-consumer
npm install
npm test

It validates direct scoped imports, xlsx alias migration and ESM usage.

Release Checklist

• Confirm npm ci succeeds.
• Confirm npm test passes.
• Confirm npm run build passes.
• Confirm make dist passes.
• Confirm npm pack --dry-run includes the expected package files.
• Install the package in a temporary consumer project.
• Test direct @stackline/xlsx usage.
• Test xlsx@npm:@stackline/xlsx alias usage.
• Run npm audit --omit=dev in the consumer project.

License

Apache-2.0. This project is a maintained fork of SheetJS Community Edition. The original SheetJS copyright and license notices are preserved in the source tree and distribution files. See NOTICE for upstream attribution and downstream maintenance details.