SheetJS/sheetjs
📗 SheetJS Spreadsheet Data Toolkit -- New home https://git.sheetjs.com/SheetJS/sheetjs
36.3k stars · 7.9k forks
At risk
At risk: no human commits in a year.
Why
- No human commits since February 2024. (source 1, source 2, source 3, source 4)
- One person wrote 70% of human commits in the last year, and no human has committed in the last 90 days. (source 1, source 2)
- The latest version of npm package xlsx has 2 high-severity security advisories (GHSA-4r6h-8v6p-xvw6, GHSA-5pgg-2g8v-p4x9). (source 1, source 2, source 3, source 4)
What would change this
- A release or merged commit from a maintainer.
- A human commit in the last 90 days, or a second person taking a large share of commits.
- The latest version is patched or the advisory is withdrawn.
Maintenance
CompleteDormant
- Human commits, 30 days
- 0
- Human commits, 90 days
- 0
- Human commits, 365 days
- 0
- Bot share of commits, 365 days
- 0%
- Last commit
- Feb 1, 2024 (2 years ago)
- Last human commit
- Feb 1, 2024 (2 years ago)
- Authors, 90 days
- 0
- Last release
- none found
- Median PR merge time
- 3 hours
Responsiveness: of 1 recent issues, n/a got a maintainer reply. Median first response: n/a.
- Only 1 recent issues can be checked for a response, too few to measure response time.
- 13 pull requests are open and nobody has committed in a year.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Organization
- Commits sampled
- 100 since Mar 8, 2022
- Authors for half of commits
- 1
- Authors for 80% of commits
- 4
- Contributors
- 171
Top committers
- SheetJSDev: 70% of commits
- reviewher: 7% of commits
- 0xc0Der: 2% of commits
- phaseOne: 2% of commits
- 390910131: 1% of commits
- No human commits in the last 365 days, so shares use the newest 100 commits back to 2022-03-08T01:17:32Z.
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- Nov 12, 2013 to Nov 15, 2013: about 102 more stars than usual, peak 46 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
- Feb 11, 2014 to Feb 12, 2014: about 25 more stars than usual, peak 14 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Nov 10, 2014 to Nov 12, 2014: about 37 more stars than usual, peak 20 in one day, a flat block of stars. Outside explanation: a jump in forks.
- Jan 28, 2015 to Jan 28, 2015: about 22 more stars than usual, peak 24 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Apr 15, 2017 to Apr 18, 2017: about 358 more stars than usual, peak 128 in one day, a shape we can't classify. Outside explanation: a jump in forks.
- Jul 30, 2017 to Aug 1, 2017: about 270 more stars than usual, peak 130 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Aug 4, 2021 to Aug 7, 2021: about 456 more stars than usual, peak 228 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Oct 21, 2021 to Oct 22, 2021: about 185 more stars than usual, peak 139 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- 46 stars on a repo created before February 2013 have no date, so they aren't in the chart.
- 4 stars GitHub has since removed (tracked since Oct 14, 2026).
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
- 46 stars on the creation day are undated (before 2013-02-10) and are not counted.
Sources: How star history is analyzed
Risk
CompleteFlags
- High: OSV, via deps.dev, lists GHSA-4r6h-8v6p-xvw6, GHSA-5pgg-2g8v-p4x9 at HIGH severity on the latest version of xlsx. Details
- Info: The OpenSSF Scorecard for this project is 2.3 out of 10 (deps.dev). Details
License
- Now
- Apache-2.0 (OSI-approved)
- A year ago
- Apache-2.0 (OSI-approved)
Packages
- xlsx (NPM): latest 0.18.5, published Mar 24, 2022
Advisories for the latest version: GHSA-4r6h-8v6p-xvw6 (high), GHSA-5pgg-2g8v-p4x9 (high)
Package and advisory data: deps.dev and OSV.
OpenSSF Scorecard: 2.3 out of 10 (via deps.dev).
Sources: GitHub: SheetJS/sheetjs, deps.dev: npm xlsx, OSV: GHSA-4r6h-8v6p-xvw6, OSV: GHSA-5pgg-2g8v-p4x9
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/SheetJS/sheetjs)Earlier verdicts
- Oct 14, 2026: At risk
- Oct 14, 2026: At risk
- Oct 13, 2026: At risk
Computed 13 hours ago · method 2026.10.2