Package evidence

@royalschedule/[email protected]

Remote Dependency Spec: dependencies.xlsx="https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,861Niche · −30% score
Versions published: 515Mature · −50% score
First published: Dec 2020
Publisher: blomquist

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@royalschedule/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@royalschedule/[email protected]"],"fail_on":"review"}'

Publisherblomquist

Artifact bytes260,831

Previous version4.1.15

Published2026-06-05T16:57:24.199Z

SHA-25657c24bba00b0236ffe482d3fdd67c852425096bb5cbc179f46fe90004d9ce7b0

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.xlsx="https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

7d agoLast checked

reviewRisk

3Score

4.1.16Version

Status history (1 event)

new → available7d ago · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.xlsx="https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"	12

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.xlsx	https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz	low	0	no remote findings

Manifest

Package metadata

Scripts24

buildtsc --noEmit && tsdown
check-circular-depsmadge --circular --extensions ts ./src
dev_Admentum tsx tests/Admentum/index.ts
dev_Core tsx tests/core/index.ts
dev_Excel tsx tests/Excel/index.ts
dev_IdunSoft tsx tests/IdunSoft/index.ts
dev_PlanDigital tsx tests/PlanDigital/index.ts
dev_Quiculum_file_to tsx tests/Quiculum/file/to/index.ts
dev_RS tsx tests/RS/index.ts
dev_RS_make_connected tsx tests/RS/make-connected.ts
dev_SS12000 tsx tests/SS12000/index.ts
dev_SchoolSoft_api tsx tests/SchoolSoft/api/index.ts
dev_SchoolSoft_file_fromtsx tests/SchoolSoft/file/from/index.ts
dev_SchoolSoft_file_to tsx tests/SchoolSoft/file/to/index.ts
dev_Schoolity tsx tests/Schoolity/index.ts
dev_Skola24:mdb tsx tests/Skola24_mdb/index.ts
dev_Skola24:txt tsx tests/Skola24_txt/index.ts
dev_identify tsx tests/identify/index.ts
dev_vKlass_from tsx tests/vKlass/file/from/index.ts
dev_vKlass_to tsx tests/vKlass/file/to/index.ts
linteslint .
lint:fixeslint . --fix
testvitest
test:civitest run --coverage

Dependencies12

@json2csv/plainjs^7.0.6
csv-parser^3.2.0
eslint-plugin-import^2.32.0
iconv-lite^0.7.2
lodash-es^4.18.1
moment^2.30.1
nanoid^5.1.11
papaparse^5.5.3
ts-expect^1.3.0
uuid^13.0.0
xlsxhttps://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
zod^4.4.3