By Alexandro · Updated 2026-11-06
Identify the installed package and its owner
A security warning is about a resolved version and affected behavior. Capture the tree before changing it:
npm ls xlsx @stackline/xlsx --all
npm explain xlsx
npm audit --json > audit-before.json
If a parent package brings in xlsx, first look for a compatible parent update. Installing another top-level package does not remove the old transitive copy. Record the lockfile's resolved tarball and integrity, not only the import name; npm aliases retain an existing import name.
Compare distribution choices
The official SheetJS installation documentation currently points to 0.20.3 on its own CDN:
npm install --save-exact https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
The state of the npm xlsx release line is not evidence that the entire SheetJS project is abandoned. Check the official installation instructions and the tarball before choosing a version.
An independently maintained fork is another choice, with a different version scheme and release responsibility:
npm install --save-exact @stackline/[email protected]
# Or retain existing imports deliberately:
npm install --save-exact xlsx@npm:@stackline/[email protected]
Do not compare 1.0.10 numerically with SheetJS 0.20.3 to infer which patches it contains. Review source changes, provenance, license and the relevant regression tests in the fork.
Relate warnings to advisories
| Advisory | Affected behavior | Upstream boundary reported by advisory |
|---|---|---|
| CVE-2023-30533 | Prototype pollution when reading crafted files | Releases before 0.19.3 |
| CVE-2024-22363 | Regular-expression denial of service | Releases before 0.20.2 |
Sources checked on 2026-11-06. Advisory matching may differ for CDN packages and renamed forks. An empty npm audit report is not proof that a renamed dependency is secure. Check the original advisory, patch lineage and reachable read/write operations; keep file-size, time and resource limits around untrusted workbooks.
Exercise the formats you actually exchange
This executable fixture uses @stackline/xlsx 1.0.10, not the official CDN build. Run it with the pinned example lockfile in this repository. It covers Unicode, numeric zero, decimal values, empty cells, XLSX/XLS/ODS round trips and CSV export:
import assert from 'node:assert/strict';
import XLSX from '@stackline/xlsx';
// No production data: representative small fixtures only.
const rows = [['Name','Value'],['Montréal',12.5],['日本語',0],['empty','']];
const book = XLSX.utils.book_new();
XLSX.utils.book_append_sheet(book, XLSX.utils.aoa_to_sheet(rows), 'Data');
for (const bookType of ['xlsx','xls','ods']) {
const bytes = XLSX.write(book, {type:'buffer',bookType});
const restored = XLSX.read(bytes, {type:'buffer'});
assert.deepEqual(XLSX.utils.sheet_to_json(restored.Sheets.Data,{header:1,defval:''}),rows);
}
const csv = XLSX.utils.sheet_to_csv(book.Sheets.Data);
assert.ok(csv.includes('Montréal'));
console.log('xlsx: XLSX/XLS/ODS value round trips and CSV export passed');
Expected: all value comparisons pass. This is a functional regression test, not an exploit test or full format certification. Add sanitized workbooks representative of your formulas, dates, number formats, merged cells, large sheets and damaged inputs. A formula's preservation and its calculation are different capabilities.
Release criteria
Compare old and new outputs, run the application's reader/export flows, inspect the final dependency tree and rerun audit. Record any advisory still applicable and why; do not suppress a warning solely because an alias changes the package name. Keep the previous lockfile and deployment artifact for rollback.