Stackline spreadsheet package

SheetJS-compatible spreadsheet parsing with security hardening.

A maintained fork for applications that need a practical replacement path for xlsx while preserving the familiar workbook API.

Install GitHub

Name

Role

Status

Ada

Engineer

Safe

Grace

Reviewer

Parsed

Version 1.0.6

API target xlsx 0.20.3

Runtime deps None

Types Included

Install

Use the scoped package directly.

npm install @stackline/xlsx

Existing apps that must keep import * as XLSX from 'xlsx' can use npm alias migration.

npm install xlsx@npm:@stackline/xlsx

Usage

Read spreadsheets in Angular or browser workflows.

import * as XLSX from '@stackline/xlsx';

export function parseWorkbook(file: ArrayBuffer) {
  const workbook = XLSX.read(file, { type: 'array' });
  const sheetName = workbook.SheetNames[0];
  return XLSX.utils.sheet_to_json(workbook.Sheets[sheetName], {
    defval: null
  });
}

Write

Create workbook data with the familiar API.

const worksheet = XLSX.utils.json_to_sheet([
  { name: 'Ada', role: 'Engineer' },
  { name: 'Grace', role: 'Reviewer' }
]);

const workbook = XLSX.utils.book_new();
XLSX.utils.book_append_sheet(workbook, worksheet, 'People');

Security

Regression coverage for known advisories.

Prototype pollution

Parser and conversion paths reject or ignore __proto__, prototype and constructor where untrusted input can become an object key.

ReDoS

The package keeps the upstream regular expression hardening and adds malformed input regression coverage.

Workbook fixtures

Tests cover XLSX, ODS, XLS, XLML, relationships, custom properties and JSON headers with malicious keys.

HTML exports can opt into hyperlink sanitization while existing output remains unchanged by default.

const html = XLSX.utils.sheet_to_html(worksheet, {
  sanitizeLinks: true
});

Formats

Format support follows the SheetJS CE 0.20.3 line.

Format family	Read	Write	Notes
XLSX / XLSM / XLSB	Yes	Yes	Modern Excel workbook formats
XLS	Yes	Yes	Legacy Excel workbook format
ODS / FODS	Yes	Yes	OpenDocument spreadsheet formats
CSV / TSV / TXT	Yes	Yes	Plaintext tabular data
HTML tables	Yes	Yes	Table import and export helpers
DBF / SYLK / DIF	Yes	Yes	Legacy interchange formats

Release

Public release checklist.

Published as @stackline/[email protected] on npm.
Run npm ci.
Run npm test.
Run npm run build.
Run make dist.
Run npm pack --dry-run.
Smoke test direct scoped usage and npm alias migration.

1.0.6 compatibility patch

TypeScript source compatibility with no runtime changes.

Legacy declarations

writeFile, writeFileXLSX and writeFileAsync preserve their established any return declarations throughout the 1.x line.

Runtime unchanged

Parsing, writing, module entrypoints and runtime exports are unchanged from 1.0.5. The file helpers still return undefined at runtime.

Release discipline

Public declarations now follow the same SemVer policy as runtime APIs, and npm adoption is recorded daily for evidence-based maintenance decisions.

Existing 1.x releases

Version 1.0.3 remains published and supported. Download share is monitored, but is not used by itself to deprecate a release; new installations should use latest.