@cj-tech-master/excelts
Zero-dependency TypeScript toolkit — Excel (XLSX), PDF, CSV, Markdown, XML, ZIP/TAR, and streaming.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): Automated publishing pipeline for a frequently-released package; rapid publishes are expected behavior here. | ai | |
| provenance | missing-githead | AI (provenance): High-velocity package with 319 versions; occasional missing gitHead is consistent with CI pipeline changes, not malicious activity. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 570 new files correspond to added Word/DOCX module functionality; consistent with the package's documented scope. | ai | |
| source-diff | obfuscated-file:dist/esm/modules/excel/chart/chart-sidecar.js | AI (source-diff): Readable compiled TypeScript output; long lines from minified build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/browser/modules/excel/chart/chart-sidecar.js | AI (source-diff): Readable compiled TypeScript output; long lines from minified build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/modules/excel/chart/chart-sidecar.js | AI (source-diff): Readable compiled TypeScript output; long lines from minified build artifact, not obfuscation. | ai | |
| source-diff | encoded-string-file:dist/browser/excelts.iife.js | AI (source-diff): Long hex strings are Diffie-Hellman prime constants from the bundled diffie-hellman npm package (primes.json). These are well-known cryptographic constants, not obfuscated payloads. Will appear in every browser bundle build. | ai |
Versions (showing 51 of 96)
| Version | Deps | Published |
|---|---|---|
| 10.2.0 | 0 / 20 | |
| 10.1.0 | 0 / 20 | |
| 10.0.0 | 0 / 20 | |
| 9.6.1 | 0 / 20 | |
| 9.6.0 | 0 / 20 | |
| 9.5.9 | 0 / 20 | |
| 9.5.8 | 0 / 20 | |
| 9.5.7 | 0 / 20 | |
| 9.5.6 | 0 / 20 | |
| 9.5.5 | 0 / 20 | |
| 9.5.4 | 0 / 20 | |
| 9.5.3 | 0 / 20 | |
| 9.5.2 | 0 / 20 | |
| 9.5.1 | 0 / 20 | |
| 9.5.0 | 0 / 20 | |
| 9.4.2 | 0 / 20 | |
| 9.4.1 | 0 / 20 | |
| 9.4.0 | 0 / 20 | |
| 9.3.1 | 0 / 20 | |
| 9.3.0 | 0 / 20 | |
| 9.2.1 | 0 / 20 | |
| 9.2.0 | 0 / 28 | |
| 9.1.0 | 0 / 29 | |
| 9.0.0 | 0 / 29 | |
| 8.1.2 | 0 / 29 | |
| 8.1.1 | 0 / 29 | |
| 8.1.0 | 0 / 29 | |
| 8.0.0 | 0 / 29 | |
| 7.6.0 | 0 / 29 | |
| 7.5.0 | 0 / 29 | |
| 7.4.0 | 0 / 29 | |
| 7.3.0 | 0 / 29 | |
| 7.2.0 | 0 / 29 | |
| 7.1.1 | 0 / 29 | |
| 7.1.0 | 0 / 29 | |
| 7.0.1 | 0 / 29 | |
| 7.0.0 | 0 / 29 | |
| 6.2.0 | 0 / 29 | |
| 6.1.3 | 0 / 27 | |
| 6.1.2 | 0 / 27 | |
| 6.1.1 | 0 / 27 | |
| 6.1.0 | 0 / 27 | |
| 6.0.0 | 0 / 27 | |
| 5.1.18 | 0 / 27 | |
| 5.1.17 | 0 / 27 | |
| 5.1.16 | 0 / 27 | |
| 5.1.15 | 0 / 27 | |
| 5.1.14 | 0 / 27 | |
| 5.1.13 | 0 / 27 | |
| 5.1.12 | 0 / 27 | |
| 5.1.11 | 0 / 27 |
v10.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.9
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.8
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cjnoname.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.4
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.3
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.2
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.1
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v7.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.