Jake Jinyong Kim · Last checked 2026-10-20
Keep ExcelJS if you want MIT-licensed code that reads, manipulates and writes XLSX files in Node.js.
Use Runstamp when one bounded change to an existing workbook has to come back with checks: xlsx.transform is documented with valid, preserved and intendedChangeVerified results.
Comparison at a glance
| Tool | License | Latest release | What its own docs say about existing .xlsx files |
|---|---|---|---|
| ExcelJS 4.4.0 | MIT | 2023-10-19 (npm latest tag) | README: reads XLSX with readFile or a stream, and writes with writeFile, a stream or writeBuffer |
SheetJS Community (xlsx) |
Apache-2.0 | npm 0.18.5, 2022-03-24; SheetJS CDN 0.20.3, tag dated 2024-07-18 | README: extracts data from spreadsheets and generates new ones; "Edit complex templates" is listed under SheetJS Pro |
| Runstamp SDK 3.1.0 | Apache-2.0 | 2026-09-14 (npm) | xlsx.transform: "Map or apply independently verified bounded changes to an existing workbook." |
Checked 2026-10-20 from the npm registry, the SheetJS documentation and CDN, the ExcelJS README and the Runstamp docs.
On "exceljs vs xlsx": the xlsx package on npm is SheetJS.
The SheetJS docs say the npm registry copy is out of date, with 0.18.5 as its latest version, and that the SheetJS CDN is the authoritative source for its modules.
When to keep ExcelJS
Keep ExcelJS if you want an MIT-licensed library that reads and writes XLSX in your own Node.js code. Its README describes itself as "Read, manipulate and write spreadsheet data and styles to XLSX and JSON." It also has sections for CSV, for a streaming XLSX writer and a streaming XLSX reader, and for formula values, shared formulas and array formulas. Its npm entry sets an engines floor of 8.3.0, while the Runstamp SDK requires Node.js 18.14.1 or later. If you only create or read workbooks and do not need a check after each change, you do not need a second tool.
Release record: The npm latest tag is 4.4.0, published 2023-10-19. A 4.4.1-prerelease.0 was published on 2024-12-20 under the prerelease tag, not the latest tag.
What Runstamp checks after an edit
The Runstamp guide for existing workbooks changes one cell, Remediation!E2, from In Progress to Closed.
You pass workbookBase64, an artifactId and a writes entry with an xlsx.a1 locator to xlsx.transform.
The output is a new XLSX file, and the source file is not overwritten.
The guide then reads result.verification.ladder and throws unless valid, preserved and intendedChangeVerified are each pass.
In a clean install of @runstamp/sdk@3.1.0 all three passed, and the guide says "Preservation covers workbook identities, styles, names, tables, hidden state, validation and cells outside the declared change."
The Runstamp docs say to refuse delivery when a requested change is absent after reopening, protected content changed, or a required verification stage is not pass.
They also say ok: true only means the operation completed under its options, not that the result can be released.
What it does not tell you:
- Formulas are not on the guide's preservation list. If your workbook's formulas matter, test them yourself.
- The local operation reports
deliveryReady: not_checked. The guide says it "does not verify formula recalculation, appearance or behavior in the recipient's Excel version, or whether Closed is the right business decision." xlsx.transformtakesworkbookBase64of up to 89,478,488 characters and 1 to 100,000writesper call. The ExcelJS README documents a streaming reader and a streaming writer.- The install shown in the Runstamp docs is
npm install @runstamp/sdk, for Node.js 18.14.1 or later.
Runstamp has seven XLSX operations in all: xlsx.convert, xlsx.inspect, xlsx.parse, xlsx.render, xlsx.repair, xlsx.transform and xlsx.validate.
For new workbooks, the docs list multiple sheets, cell styles, merges, filters, formulas, hyperlinks and print setup for xlsx.render, with deterministic output.
The conformance page lists @runstamp/xlsx as passing all 18 contract gates, which it defines as the implementation matching its declared contract.
Licenses and release dates
| Tool | License | Release | Source |
|---|---|---|---|
| ExcelJS | MIT, copyright 2014-2019 Guyon Roche | 4.4.0, 2023-10-19 (latest tag); 4.4.1-prerelease.0, 2024-12-20 (prerelease tag) | npm registry, LICENSE file |
| SheetJS Community | Apache-2.0; "All rights not explicitly granted by the Apache 2.0 License are reserved by the Original Author." | npm 0.18.5, 2022-03-24; SheetJS CDN list ends at 0.20.3, tag dated 2024-07-18 | npm registry, SheetJS CDN and git |
Runstamp SDK (@runstamp/sdk) |
Apache-2.0, free local package including the XLSX engine | 3.1.0, 2026-09-14 | npm registry, Runstamp license page |
The SheetJS CDN page calls Apache 2.0 "a permissive license with certain attribution requirements", so read it before you vendor the code.
How we checked
On 2026-10-20 we read the npm registry entries for exceljs, xlsx and @runstamp/sdk, the ExcelJS README and LICENSE, the SheetJS README, CDN, git tags page and installation docs, and the Runstamp docs, and we saved each raw capture.
We did not run ExcelJS or SheetJS, so we make no statement about how either behaves on a particular workbook.
Runstamp behavior on this page comes from the Runstamp docs repository read on the same day, at commit 3cb9413.
We did not run the Runstamp operations for this page.
Sources, all fetched 2026-10-20: