# lodash-es@4.18.1 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:17:59.000Z - Files reviewed: 644 - Findings: 2 medium, 3 low severity findings - Report: https://security.togoder.click/npm/lodash-es - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package lodash-es@4.18.1 on Oct 6, 2026. An AI review of 644 source files produced 2 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [medium] Source code generation Finding ID: `NPS-C06D107545C8` File: `template.js:225` The function generates JavaScript source code by concatenating template parts, including user-provided interpolate/evaluate expressions and variable names. Although there are checks (reForbiddenIdentifierChars) to prevent certain injection vectors in the 'variable' option and import keys, the generated code is then executed via new Function. This is a known insecure pattern by design. ### [medium] Dynamic code execution Finding ID: `NPS-A8EE790E4596` File: `template.js:293` The template function compiles user-supplied template strings into executable JavaScript using the Function constructor. While this is the intended behavior of lodash's template feature, it constitutes dynamic code execution. The function itself includes security warnings in its documentation ('_.template is insecure and should not be used'), and validates certain forbidden characters in variable names and imports to mitigate injection risks. However, if an attacker can control the template string or options, arbitrary code execution is possible. ### [low] Prototype pollution protection Finding ID: `NPS-36912F2415E4` File: `_baseUnset.js` The function explicitly checks for and blocks '__proto__', 'constructor', and 'prototype' keys in property paths to prevent prototype pollution vulnerabilities. This is a defensive security measure, not a malicious pattern. ### [low] Dynamic code execution Finding ID: `NPS-53D493E9D7D0` File: `_root.js:7` Uses `Function('return this')()` to obtain the global object. This is a form of dynamic code evaluation (similar to eval/new Function) that can be exploited in CSP-restricted environments and is generally discouraged for security-sensitive contexts, though it is a well-known idiom in Lodash's global object detection. ### [low] Insecure documentation warning Finding ID: `NPS-FEFAC5FF1859` File: `template.js:86` The code itself contains a prominent security warning in its JSDoc: '_.template is insecure and should not be used... Avoid untrusted input.' This is an acknowledgment of the inherent risk in the API. This is not a malicious pattern but is a security concern if the library is used with untrusted input. ## Files reviewed - `_root.js` (medium): This is a standard Lodash internal utility for detecting the global object; it contains a benign but noteworthy use of dynamic Function construction with no signs of malicious behavior, exfiltration, or credential harvesting. - `template.js` (medium): The file is the lodash `template` function, which uses `new Function` for dynamic code execution by design; while it includes mitigations and explicit security warnings, it remains inherently unsafe if fed untrusted input, but no active malicious behavior (exfiltration, backdoors, etc.) was found. - `_DataView.js` (safe): No malicious patterns detected - `_Hash.js` (safe): Cleared by Jev triage; no further analysis needed - `_LazyWrapper.js` (safe): Cleared by Jev triage; no further analysis needed - `_ListCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_LodashWrapper.js` (safe): Cleared by Jev triage; no further analysis needed - `_Map.js` (safe): No malicious patterns detected; this is a standard lodash internal module for retrieving the native Map constructor. - `_MapCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_Promise.js` (safe): No malicious patterns detected - `_Set.js` (safe): Cleared by Jev triage; no further analysis needed - `_SetCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_Stack.js` (safe): Cleared by Jev triage; no further analysis needed - `_Symbol.js` (safe): Cleared by Jev triage; no further analysis needed - `_Uint8Array.js` (safe): Cleared by Jev triage; no further analysis needed - `_WeakMap.js` (safe): No malicious patterns detected - `_addMapEntry.js` (safe): Cleared by Jev triage; no further analysis needed - `_addSetEntry.js` (safe): Cleared by Jev triage; no further analysis needed - `_apply.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEachRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEvery.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayFilter.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayIncludes.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayIncludesWith.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayLikeKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayPush.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayReduce.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayReduceRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySample.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySampleSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayShuffle.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySome.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiToArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiWords.js` (safe): Cleared by Jev triage; no further analysis needed - `_assignMergeValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_assignValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_assocIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssign.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssignValue.js` (safe): No malicious patterns detected; this is a standard lodash utility function for safe property assignment. - `_baseAt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseClamp.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseClone.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseConforms.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseConformsTo.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseDelay.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseDifference.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEachRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEvery.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseExtremum.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFill.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFilter.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFindIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFindKey.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFlatten.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFor.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForOwn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForOwnRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFunctions.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGet.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGetAllKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGetTag.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseHas.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseHasIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIndexOfWith.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIntersection.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInverter.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInvoke.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsArguments.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsDate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsEqual.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsEqualDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsMatch.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsNaN.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsNative.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsSet.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIteratee.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseKeysIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseLodash.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseLt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMatches.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMatchesProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMean.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMerge.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMergeDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseNth.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseOrderBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePick.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePickBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePropertyDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePropertyOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePullAll.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePullAt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRandom.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseReduce.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRepeat.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRest.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSample.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSampleSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSet.js` (safe): No malicious patterns detected; this is a standard lodash-style baseSet utility with explicit prototype pollution protections. - `_baseSetData.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSetToString.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseShuffle.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSlice.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSome.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedIndexBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedUniq.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSum.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseTimes.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToNumber.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToPairs.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToString.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseTrim.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUnary.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUniq.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUnset.js` (safe): This is a legitimate lodash utility function that implements prototype pollution protection for _.unset, with no malicious patterns detected. - `_baseUpdate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseValues.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseWhile.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseWrapperValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseXor.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseZipObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_cacheHas.js` (safe): Cleared by Jev triage; no further analysis needed - `_castArrayLikeObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_castFunction.js` (safe): Cleared by Jev triage; no further analysis needed - `_castPath.js` (safe): Cleared by Jev triage; no further analysis needed - `_castRest.js` (safe): Cleared by Jev triage; no further analysis needed - `_castSlice.js` (safe): Cleared by Jev triage; no further analysis needed - `_charsEndIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_charsStartIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneDataView.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneSet.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneSymbol.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_compareAscending.js` (safe): Cleared by Jev triage; no further analysis needed - `_compareMultiple.js` (safe): Cleared by Jev triage; no further analysis needed - `_composeArgs.js` (safe): Cleared by Jev triage; no further analysis needed - `_composeArgsRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_copyArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_copyObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_copySymbols.js` (safe): Cleared by Jev triage; no further analysis needed - `_copySymbolsIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_coreJsData.js` (safe): Cleared by Jev triage; no further analysis needed - `_countHolders.js` (safe): Cleared by Jev triage; no further analysis needed - `_createAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_createAssigner.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBaseEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBaseFor.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBind.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCaseFirst.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCompounder.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCtor.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCurry.js` (safe): Cleared by Jev triage; no further analysis needed - `_createFind.js` (safe): Cleared by Jev triage; no further analysis needed - `_createFlow.js` (safe): Cleared by Jev triage; no further analysis needed - `_createHybrid.js` (safe): Cleared by Jev triage; no further analysis needed - `_createInverter.js` (safe): Cleared by Jev triage; no further analysis needed - `_createMathOperation.js` (safe): Cleared by Jev triage; no further analysis needed - `_createOver.js` (safe): Cleared by Jev triage; no further analysis needed - `_createPadding.js` (safe): Cleared by Jev triage; no further analysis needed - `_createPartial.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRecurry.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRelationalOperation.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRound.js` (safe): Cleared by Jev triage; no further analysis needed - `_createSet.js` (safe): No malicious patterns detected; the file is a standard utility for creating Set objects with a feature check. - `_createToPairs.js` (safe): Cleared by Jev triage; no further analysis needed - `_createWrap.js` (safe): Cleared by Jev triage; no further analysis needed - `_customDefaultsAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_customDefaultsMerge.js` (safe): Cleared by Jev triage; no further analysis needed - `_customOmitClone.js` (safe): Cleared by Jev triage; no further analysis needed - `_deburrLetter.js` (safe): Cleared by Jev triage; no further analysis needed - `_defineProperty.js` (safe): No malicious patterns detected - `_equalArrays.js` (safe): Cleared by Jev triage; no further analysis needed - `_equalByTag.js` (safe): Cleared by Jev triage; no further analysis needed AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology