Vendor xlsx?

[ArnaudBarre]

Hi, thanks for the package, we are considering using it but I was surprised that xlsx is not published on npm and is just a raw link to a non shared cdn, so the attack vector is quite big I think. Given that the version is hardcoded anyway, did you tough about bundling the lib? It would require some work for bundling types too, but that would make things cleaner.

[smallsaucepan]

Hi @ArnaudBarre. In case it helps, I got here via NPM - https://www.npmjs.com/package/node-xlsx

[metamorfoso]

I think Arnaud is talking about xlsx, which is a dependency of node-xlsx.

If you look at your lockfile, you'll see that the URL for xlsx points to a random private tarball rather than npm. For example, here's the entry from my pnpm lockfile:

+  node-xlsx@0.24.0:
+    dependencies:
+      xlsx: https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz
+

I agree it feels bad to have someone's random tarball downloaded into your deps each time you install. I guess hosting on npm doesn't fully guard against the attack vector... it just adds some social proofing.

One way to reduce the attack surface as a consumer is to download a copy of that version of xlsx, host it somewhere yourself, and then add an override for your package manager to download it from your URL.

That way at least you can be sure of what you're downloading each time you install.

It's a maintenance burden, yes, but I wouldn't expect the maintainers of node-xlsx to take that burden on. Maybe just call out in the readme the fact that the dep is privately hosted.