lodash-es@4.18.1 security report: Needs review

Summary

Togoder Security scanned the npm package lodash-es@4.18.1 on Oct 6, 2026. An AI review of 644 source files produced 2 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

critical

high

medium

low

Findings 5

medium

Source code generation

NPS-C06D107545C8

The function generates JavaScript source code by concatenating template parts, including user-provided interpolate/evaluate expressions and variable names. Although there are checks (reForbiddenIdentifierChars) to prevent certain injection vectors in the 'variable' option and import keys, the generated code is then executed via new Function. This is a known insecure pattern by design.

template.js:225

medium

Dynamic code execution

NPS-A8EE790E4596

The template function compiles user-supplied template strings into executable JavaScript using the Function constructor. While this is the intended behavior of lodash's template feature, it constitutes dynamic code execution. The function itself includes security warnings in its documentation ('_.template is insecure and should not be used'), and validates certain forbidden characters in variable names and imports to mitigate injection risks. However, if an attacker can control the template string or options, arbitrary code execution is possible.

template.js:293

low

Prototype pollution protection

NPS-36912F2415E4

The function explicitly checks for and blocks '__proto__', 'constructor', and 'prototype' keys in property paths to prevent prototype pollution vulnerabilities. This is a defensive security measure, not a malicious pattern.

_baseUnset.js

low

Dynamic code execution

NPS-53D493E9D7D0

Uses Function('return this')() to obtain the global object. This is a form of dynamic code evaluation (similar to eval/new Function) that can be exploited in CSP-restricted environments and is generally discouraged for security-sensitive contexts, though it is a well-known idiom in Lodash's global object detection.

_root.js:7

low

Insecure documentation warning

NPS-FEFAC5FF1859

The code itself contains a prominent security warning in its JSDoc: '_.template is insecure and should not be used... Avoid untrusted input.' This is an acknowledgment of the inherent risk in the API. This is not a malicious pattern but is a security concern if the library is used with untrusted input.

template.js:86

Files reviewed

File	Verdict	What the reviewer saw
_root.js	medium	This is a standard Lodash internal utility for detecting the global object; it contains a benign but noteworthy use of dynamic Function construction with no signs of malicious behavior, exfiltration, or credential harvesting.
template.js	medium	The file is the lodash `template` function, which uses `new Function` for dynamic code execution by design; while it includes mitigations and explicit security warnings, it remains inherently unsafe if fed untrusted input, but no active malicious behavior (exfiltration, backdoors, etc.) was found.
_DataView.js	safe	No malicious patterns detected
_Hash.js	safe	Cleared by Jev triage; no further analysis needed
_LazyWrapper.js	safe	Cleared by Jev triage; no further analysis needed
_ListCache.js	safe	Cleared by Jev triage; no further analysis needed
_LodashWrapper.js	safe	Cleared by Jev triage; no further analysis needed
_Map.js	safe	No malicious patterns detected; this is a standard lodash internal module for retrieving the native Map constructor.
_MapCache.js	safe	Cleared by Jev triage; no further analysis needed
_Promise.js	safe	No malicious patterns detected
_Set.js	safe	Cleared by Jev triage; no further analysis needed
_SetCache.js	safe	Cleared by Jev triage; no further analysis needed
_Stack.js	safe	Cleared by Jev triage; no further analysis needed
_Symbol.js	safe	Cleared by Jev triage; no further analysis needed
_Uint8Array.js	safe	Cleared by Jev triage; no further analysis needed
_WeakMap.js	safe	No malicious patterns detected
_addMapEntry.js	safe	Cleared by Jev triage; no further analysis needed
_addSetEntry.js	safe	Cleared by Jev triage; no further analysis needed
_apply.js	safe	Cleared by Jev triage; no further analysis needed
_arrayAggregator.js	safe	Cleared by Jev triage; no further analysis needed
_arrayEach.js	safe	Cleared by Jev triage; no further analysis needed
_arrayEachRight.js	safe	Cleared by Jev triage; no further analysis needed
_arrayEvery.js	safe	Cleared by Jev triage; no further analysis needed
_arrayFilter.js	safe	Cleared by Jev triage; no further analysis needed
_arrayIncludes.js	safe	Cleared by Jev triage; no further analysis needed

Show 619 more files

File	Verdict	What the reviewer saw
_arrayIncludesWith.js	safe	Cleared by Jev triage; no further analysis needed
_arrayLikeKeys.js	safe	Cleared by Jev triage; no further analysis needed
_arrayMap.js	safe	Cleared by Jev triage; no further analysis needed
_arrayPush.js	safe	Cleared by Jev triage; no further analysis needed
_arrayReduce.js	safe	Cleared by Jev triage; no further analysis needed
_arrayReduceRight.js	safe	Cleared by Jev triage; no further analysis needed
_arraySample.js	safe	Cleared by Jev triage; no further analysis needed
_arraySampleSize.js	safe	Cleared by Jev triage; no further analysis needed
_arrayShuffle.js	safe	Cleared by Jev triage; no further analysis needed
_arraySome.js	safe	Cleared by Jev triage; no further analysis needed
_asciiSize.js	safe	Cleared by Jev triage; no further analysis needed
_asciiToArray.js	safe	Cleared by Jev triage; no further analysis needed
_asciiWords.js	safe	Cleared by Jev triage; no further analysis needed
_assignMergeValue.js	safe	Cleared by Jev triage; no further analysis needed
_assignValue.js	safe	Cleared by Jev triage; no further analysis needed
_assocIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
_baseAggregator.js	safe	Cleared by Jev triage; no further analysis needed
_baseAssign.js	safe	Cleared by Jev triage; no further analysis needed
_baseAssignIn.js	safe	Cleared by Jev triage; no further analysis needed
_baseAssignValue.js	safe	No malicious patterns detected; this is a standard lodash utility function for safe property assignment.
_baseAt.js	safe	Cleared by Jev triage; no further analysis needed
_baseClamp.js	safe	Cleared by Jev triage; no further analysis needed
_baseClone.js	safe	Cleared by Jev triage; no further analysis needed
_baseConforms.js	safe	Cleared by Jev triage; no further analysis needed
_baseConformsTo.js	safe	Cleared by Jev triage; no further analysis needed
_baseCreate.js	safe	Cleared by Jev triage; no further analysis needed
_baseDelay.js	safe	Cleared by Jev triage; no further analysis needed
_baseDifference.js	safe	Cleared by Jev triage; no further analysis needed
_baseEach.js	safe	Cleared by Jev triage; no further analysis needed
_baseEachRight.js	safe	Cleared by Jev triage; no further analysis needed
_baseEvery.js	safe	Cleared by Jev triage; no further analysis needed
_baseExtremum.js	safe	Cleared by Jev triage; no further analysis needed
_baseFill.js	safe	Cleared by Jev triage; no further analysis needed
_baseFilter.js	safe	Cleared by Jev triage; no further analysis needed
_baseFindIndex.js	safe	Cleared by Jev triage; no further analysis needed
_baseFindKey.js	safe	Cleared by Jev triage; no further analysis needed
_baseFlatten.js	safe	Cleared by Jev triage; no further analysis needed
_baseFor.js	safe	Cleared by Jev triage; no further analysis needed
_baseForOwn.js	safe	Cleared by Jev triage; no further analysis needed
_baseForOwnRight.js	safe	Cleared by Jev triage; no further analysis needed
_baseForRight.js	safe	Cleared by Jev triage; no further analysis needed
_baseFunctions.js	safe	Cleared by Jev triage; no further analysis needed
_baseGet.js	safe	Cleared by Jev triage; no further analysis needed
_baseGetAllKeys.js	safe	Cleared by Jev triage; no further analysis needed
_baseGetTag.js	safe	Cleared by Jev triage; no further analysis needed
_baseGt.js	safe	Cleared by Jev triage; no further analysis needed
_baseHas.js	safe	Cleared by Jev triage; no further analysis needed
_baseHasIn.js	safe	Cleared by Jev triage; no further analysis needed
_baseInRange.js	safe	Cleared by Jev triage; no further analysis needed
_baseIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
_baseIndexOfWith.js	safe	Cleared by Jev triage; no further analysis needed
_baseIntersection.js	safe	Cleared by Jev triage; no further analysis needed
_baseInverter.js	safe	Cleared by Jev triage; no further analysis needed
_baseInvoke.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsArguments.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsArrayBuffer.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsDate.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsEqual.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsEqualDeep.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsMap.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsMatch.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsNaN.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsNative.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsRegExp.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsSet.js	safe	Cleared by Jev triage; no further analysis needed
_baseIsTypedArray.js	safe	Cleared by Jev triage; no further analysis needed
_baseIteratee.js	safe	Cleared by Jev triage; no further analysis needed
_baseKeys.js	safe	Cleared by Jev triage; no further analysis needed
_baseKeysIn.js	safe	Cleared by Jev triage; no further analysis needed
_baseLodash.js	safe	Cleared by Jev triage; no further analysis needed
_baseLt.js	safe	Cleared by Jev triage; no further analysis needed
_baseMap.js	safe	Cleared by Jev triage; no further analysis needed
_baseMatches.js	safe	Cleared by Jev triage; no further analysis needed
_baseMatchesProperty.js	safe	Cleared by Jev triage; no further analysis needed
_baseMean.js	safe	Cleared by Jev triage; no further analysis needed
_baseMerge.js	safe	Cleared by Jev triage; no further analysis needed
_baseMergeDeep.js	safe	Cleared by Jev triage; no further analysis needed
_baseNth.js	safe	Cleared by Jev triage; no further analysis needed
_baseOrderBy.js	safe	Cleared by Jev triage; no further analysis needed
_basePick.js	safe	Cleared by Jev triage; no further analysis needed
_basePickBy.js	safe	Cleared by Jev triage; no further analysis needed
_baseProperty.js	safe	Cleared by Jev triage; no further analysis needed
_basePropertyDeep.js	safe	Cleared by Jev triage; no further analysis needed
_basePropertyOf.js	safe	Cleared by Jev triage; no further analysis needed
_basePullAll.js	safe	Cleared by Jev triage; no further analysis needed
_basePullAt.js	safe	Cleared by Jev triage; no further analysis needed
_baseRandom.js	safe	Cleared by Jev triage; no further analysis needed
_baseRange.js	safe	Cleared by Jev triage; no further analysis needed
_baseReduce.js	safe	Cleared by Jev triage; no further analysis needed
_baseRepeat.js	safe	Cleared by Jev triage; no further analysis needed
_baseRest.js	safe	Cleared by Jev triage; no further analysis needed
_baseSample.js	safe	Cleared by Jev triage; no further analysis needed
_baseSampleSize.js	safe	Cleared by Jev triage; no further analysis needed
_baseSet.js	safe	No malicious patterns detected; this is a standard lodash-style baseSet utility with explicit prototype pollution protections.
_baseSetData.js	safe	Cleared by Jev triage; no further analysis needed
_baseSetToString.js	safe	Cleared by Jev triage; no further analysis needed
_baseShuffle.js	safe	Cleared by Jev triage; no further analysis needed
_baseSlice.js	safe	Cleared by Jev triage; no further analysis needed
_baseSome.js	safe	Cleared by Jev triage; no further analysis needed
_baseSortBy.js	safe	Cleared by Jev triage; no further analysis needed
_baseSortedIndex.js	safe	Cleared by Jev triage; no further analysis needed
_baseSortedIndexBy.js	safe	Cleared by Jev triage; no further analysis needed
_baseSortedUniq.js	safe	Cleared by Jev triage; no further analysis needed
_baseSum.js	safe	Cleared by Jev triage; no further analysis needed
_baseTimes.js	safe	Cleared by Jev triage; no further analysis needed
_baseToNumber.js	safe	Cleared by Jev triage; no further analysis needed
_baseToPairs.js	safe	Cleared by Jev triage; no further analysis needed
_baseToString.js	safe	Cleared by Jev triage; no further analysis needed
_baseTrim.js	safe	Cleared by Jev triage; no further analysis needed
_baseUnary.js	safe	Cleared by Jev triage; no further analysis needed
_baseUniq.js	safe	Cleared by Jev triage; no further analysis needed
_baseUnset.js	safe	This is a legitimate lodash utility function that implements prototype pollution protection for _.unset, with no malicious patterns detected.
_baseUpdate.js	safe	Cleared by Jev triage; no further analysis needed
_baseValues.js	safe	Cleared by Jev triage; no further analysis needed
_baseWhile.js	safe	Cleared by Jev triage; no further analysis needed
_baseWrapperValue.js	safe	Cleared by Jev triage; no further analysis needed
_baseXor.js	safe	Cleared by Jev triage; no further analysis needed
_baseZipObject.js	safe	Cleared by Jev triage; no further analysis needed
_cacheHas.js	safe	Cleared by Jev triage; no further analysis needed
_castArrayLikeObject.js	safe	Cleared by Jev triage; no further analysis needed
_castFunction.js	safe	Cleared by Jev triage; no further analysis needed
_castPath.js	safe	Cleared by Jev triage; no further analysis needed
_castRest.js	safe	Cleared by Jev triage; no further analysis needed
_castSlice.js	safe	Cleared by Jev triage; no further analysis needed
_charsEndIndex.js	safe	Cleared by Jev triage; no further analysis needed
_charsStartIndex.js	safe	Cleared by Jev triage; no further analysis needed
_cloneArrayBuffer.js	safe	Cleared by Jev triage; no further analysis needed
_cloneBuffer.js	safe	Cleared by Jev triage; no further analysis needed
_cloneDataView.js	safe	Cleared by Jev triage; no further analysis needed
_cloneMap.js	safe	Cleared by Jev triage; no further analysis needed
_cloneRegExp.js	safe	Cleared by Jev triage; no further analysis needed
_cloneSet.js	safe	Cleared by Jev triage; no further analysis needed
_cloneSymbol.js	safe	Cleared by Jev triage; no further analysis needed
_cloneTypedArray.js	safe	Cleared by Jev triage; no further analysis needed
_compareAscending.js	safe	Cleared by Jev triage; no further analysis needed
_compareMultiple.js	safe	Cleared by Jev triage; no further analysis needed
_composeArgs.js	safe	Cleared by Jev triage; no further analysis needed
_composeArgsRight.js	safe	Cleared by Jev triage; no further analysis needed
_copyArray.js	safe	Cleared by Jev triage; no further analysis needed
_copyObject.js	safe	Cleared by Jev triage; no further analysis needed
_copySymbols.js	safe	Cleared by Jev triage; no further analysis needed
_copySymbolsIn.js	safe	Cleared by Jev triage; no further analysis needed
_coreJsData.js	safe	Cleared by Jev triage; no further analysis needed
_countHolders.js	safe	Cleared by Jev triage; no further analysis needed
_createAggregator.js	safe	Cleared by Jev triage; no further analysis needed
_createAssigner.js	safe	Cleared by Jev triage; no further analysis needed
_createBaseEach.js	safe	Cleared by Jev triage; no further analysis needed
_createBaseFor.js	safe	Cleared by Jev triage; no further analysis needed
_createBind.js	safe	Cleared by Jev triage; no further analysis needed
_createCaseFirst.js	safe	Cleared by Jev triage; no further analysis needed
_createCompounder.js	safe	Cleared by Jev triage; no further analysis needed
_createCtor.js	safe	Cleared by Jev triage; no further analysis needed
_createCurry.js	safe	Cleared by Jev triage; no further analysis needed
_createFind.js	safe	Cleared by Jev triage; no further analysis needed
_createFlow.js	safe	Cleared by Jev triage; no further analysis needed
_createHybrid.js	safe	Cleared by Jev triage; no further analysis needed
_createInverter.js	safe	Cleared by Jev triage; no further analysis needed
_createMathOperation.js	safe	Cleared by Jev triage; no further analysis needed
_createOver.js	safe	Cleared by Jev triage; no further analysis needed
_createPadding.js	safe	Cleared by Jev triage; no further analysis needed
_createPartial.js	safe	Cleared by Jev triage; no further analysis needed
_createRange.js	safe	Cleared by Jev triage; no further analysis needed
_createRecurry.js	safe	Cleared by Jev triage; no further analysis needed
_createRelationalOperation.js	safe	Cleared by Jev triage; no further analysis needed
_createRound.js	safe	Cleared by Jev triage; no further analysis needed
_createSet.js	safe	No malicious patterns detected; the file is a standard utility for creating Set objects with a feature check.
_createToPairs.js	safe	Cleared by Jev triage; no further analysis needed
_createWrap.js	safe	Cleared by Jev triage; no further analysis needed
_customDefaultsAssignIn.js	safe	Cleared by Jev triage; no further analysis needed
_customDefaultsMerge.js	safe	Cleared by Jev triage; no further analysis needed
_customOmitClone.js	safe	Cleared by Jev triage; no further analysis needed
_deburrLetter.js	safe	Cleared by Jev triage; no further analysis needed
_defineProperty.js	safe	No malicious patterns detected
_equalArrays.js	safe	Cleared by Jev triage; no further analysis needed
_equalByTag.js	safe	Cleared by Jev triage; no further analysis needed
_equalObjects.js	safe	Cleared by Jev triage; no further analysis needed
_escapeHtmlChar.js	safe	Cleared by Jev triage; no further analysis needed
_escapeStringChar.js	safe	Cleared by Jev triage; no further analysis needed
_flatRest.js	safe	Cleared by Jev triage; no further analysis needed
_freeGlobal.js	safe	Cleared by Jev triage; no further analysis needed
_getAllKeys.js	safe	Cleared by Jev triage; no further analysis needed
_getAllKeysIn.js	safe	Cleared by Jev triage; no further analysis needed
_getData.js	safe	Cleared by Jev triage; no further analysis needed
_getFuncName.js	safe	Cleared by Jev triage; no further analysis needed
_getHolder.js	safe	Cleared by Jev triage; no further analysis needed
_getMapData.js	safe	Cleared by Jev triage; no further analysis needed
_getMatchData.js	safe	Cleared by Jev triage; no further analysis needed
_getNative.js	safe	Cleared by Jev triage; no further analysis needed
_getPrototype.js	safe	Cleared by Jev triage; no further analysis needed
_getRawTag.js	safe	Cleared by Jev triage; no further analysis needed
_getSymbols.js	safe	Cleared by Jev triage; no further analysis needed
_getSymbolsIn.js	safe	Cleared by Jev triage; no further analysis needed
_getTag.js	safe	No malicious patterns detected; the file is a standard lodash internal utility for detecting object toString tags.
_getValue.js	safe	Cleared by Jev triage; no further analysis needed
_getView.js	safe	Cleared by Jev triage; no further analysis needed
_getWrapDetails.js	safe	Cleared by Jev triage; no further analysis needed
_hasPath.js	safe	Cleared by Jev triage; no further analysis needed
_hasUnicode.js	safe	No malicious patterns detected
_hasUnicodeWord.js	safe	Cleared by Jev triage; no further analysis needed
_hashClear.js	safe	Cleared by Jev triage; no further analysis needed
_hashDelete.js	safe	Cleared by Jev triage; no further analysis needed
_hashGet.js	safe	Cleared by Jev triage; no further analysis needed
_hashHas.js	safe	Cleared by Jev triage; no further analysis needed
_hashSet.js	safe	Cleared by Jev triage; no further analysis needed
_initCloneArray.js	safe	Cleared by Jev triage; no further analysis needed
_initCloneByTag.js	safe	Cleared by Jev triage; no further analysis needed
_initCloneObject.js	safe	Cleared by Jev triage; no further analysis needed
_insertWrapDetails.js	safe	Cleared by Jev triage; no further analysis needed
_isFlattenable.js	safe	Cleared by Jev triage; no further analysis needed
_isIndex.js	safe	Cleared by Jev triage; no further analysis needed
_isIterateeCall.js	safe	Cleared by Jev triage; no further analysis needed
_isKey.js	safe	Cleared by Jev triage; no further analysis needed
_isKeyable.js	safe	Cleared by Jev triage; no further analysis needed
_isLaziable.js	safe	Cleared by Jev triage; no further analysis needed
_isMaskable.js	safe	Cleared by Jev triage; no further analysis needed
_isMasked.js	safe	Cleared by Jev triage; no further analysis needed
_isPrototype.js	safe	Cleared by Jev triage; no further analysis needed
_isStrictComparable.js	safe	Cleared by Jev triage; no further analysis needed
_iteratorToArray.js	safe	Cleared by Jev triage; no further analysis needed
_lazyClone.js	safe	Cleared by Jev triage; no further analysis needed
_lazyReverse.js	safe	Cleared by Jev triage; no further analysis needed
_lazyValue.js	safe	Cleared by Jev triage; no further analysis needed
_listCacheClear.js	safe	Cleared by Jev triage; no further analysis needed
_listCacheDelete.js	safe	Cleared by Jev triage; no further analysis needed
_listCacheGet.js	safe	Cleared by Jev triage; no further analysis needed
_listCacheHas.js	safe	Cleared by Jev triage; no further analysis needed
_listCacheSet.js	safe	Cleared by Jev triage; no further analysis needed
_mapCacheClear.js	safe	Cleared by Jev triage; no further analysis needed
_mapCacheDelete.js	safe	Cleared by Jev triage; no further analysis needed
_mapCacheGet.js	safe	Cleared by Jev triage; no further analysis needed
_mapCacheHas.js	safe	Cleared by Jev triage; no further analysis needed
_mapCacheSet.js	safe	Cleared by Jev triage; no further analysis needed
_mapToArray.js	safe	Cleared by Jev triage; no further analysis needed
_matchesStrictComparable.js	safe	Cleared by Jev triage; no further analysis needed
_memoizeCapped.js	safe	Cleared by Jev triage; no further analysis needed
_mergeData.js	safe	Cleared by Jev triage; no further analysis needed
_metaMap.js	safe	Cleared by Jev triage; no further analysis needed
_nativeCreate.js	safe	No malicious patterns detected
_nativeKeys.js	safe	Cleared by Jev triage; no further analysis needed
_nativeKeysIn.js	safe	Cleared by Jev triage; no further analysis needed
_nodeUtil.js	safe	No malicious patterns detected; the file is a legitimate Lodash internal utility that safely detects Node.js util.types for optimization.
_objectToString.js	safe	Cleared by Jev triage; no further analysis needed
_overArg.js	safe	Cleared by Jev triage; no further analysis needed
_overRest.js	safe	Cleared by Jev triage; no further analysis needed
_parent.js	safe	Cleared by Jev triage; no further analysis needed
_reEscape.js	safe	Cleared by Jev triage; no further analysis needed
_reEvaluate.js	safe	Cleared by Jev triage; no further analysis needed
_reInterpolate.js	safe	Cleared by Jev triage; no further analysis needed
_realNames.js	safe	Cleared by Jev triage; no further analysis needed
_reorder.js	safe	Cleared by Jev triage; no further analysis needed
_replaceHolders.js	safe	Cleared by Jev triage; no further analysis needed
_safeGet.js	safe	Cleared by Jev triage; no further analysis needed
_setCacheAdd.js	safe	Cleared by Jev triage; no further analysis needed
_setCacheHas.js	safe	Cleared by Jev triage; no further analysis needed
_setData.js	safe	Cleared by Jev triage; no further analysis needed
_setToArray.js	safe	Cleared by Jev triage; no further analysis needed
_setToPairs.js	safe	Cleared by Jev triage; no further analysis needed
_setToString.js	safe	Cleared by Jev triage; no further analysis needed
_setWrapToString.js	safe	Cleared by Jev triage; no further analysis needed
_shortOut.js	safe	Cleared by Jev triage; no further analysis needed
_shuffleSelf.js	safe	Cleared by Jev triage; no further analysis needed
_stackClear.js	safe	Cleared by Jev triage; no further analysis needed
_stackDelete.js	safe	Cleared by Jev triage; no further analysis needed
_stackGet.js	safe	Cleared by Jev triage; no further analysis needed
_stackHas.js	safe	Cleared by Jev triage; no further analysis needed
_stackSet.js	safe	Cleared by Jev triage; no further analysis needed
_strictIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
_strictLastIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
_stringSize.js	safe	Cleared by Jev triage; no further analysis needed
_stringToArray.js	safe	Cleared by Jev triage; no further analysis needed
_stringToPath.js	safe	Cleared by Jev triage; no further analysis needed
_toKey.js	safe	Cleared by Jev triage; no further analysis needed
_toSource.js	safe	Cleared by Jev triage; no further analysis needed
_trimmedEndIndex.js	safe	Cleared by Jev triage; no further analysis needed
_unescapeHtmlChar.js	safe	Cleared by Jev triage; no further analysis needed
_unicodeSize.js	safe	No malicious patterns detected
_unicodeToArray.js	safe	No malicious patterns detected
_unicodeWords.js	safe	No malicious patterns detected; this is a standard Unicode word-splitting regex utility from lodash.
_updateWrapDetails.js	safe	Cleared by Jev triage; no further analysis needed
_wrapperClone.js	safe	Cleared by Jev triage; no further analysis needed
add.js	safe	Cleared by Jev triage; no further analysis needed
after.js	safe	Cleared by Jev triage; no further analysis needed
array.default.js	safe	Cleared by Jev triage; no further analysis needed
array.js	safe	Cleared by Jev triage; no further analysis needed
ary.js	safe	Cleared by Jev triage; no further analysis needed
assign.js	safe	Cleared by Jev triage; no further analysis needed
assignIn.js	safe	Cleared by Jev triage; no further analysis needed
assignInWith.js	safe	Cleared by Jev triage; no further analysis needed
assignWith.js	safe	Cleared by Jev triage; no further analysis needed
at.js	safe	Cleared by Jev triage; no further analysis needed
attempt.js	safe	Cleared by Jev triage; no further analysis needed
before.js	safe	Cleared by Jev triage; no further analysis needed
bind.js	safe	Cleared by Jev triage; no further analysis needed
bindAll.js	safe	Cleared by Jev triage; no further analysis needed
bindKey.js	safe	Cleared by Jev triage; no further analysis needed
camelCase.js	safe	Cleared by Jev triage; no further analysis needed
capitalize.js	safe	Cleared by Jev triage; no further analysis needed
castArray.js	safe	Cleared by Jev triage; no further analysis needed
ceil.js	safe	Cleared by Jev triage; no further analysis needed
chain.js	safe	Cleared by Jev triage; no further analysis needed
chunk.js	safe	Cleared by Jev triage; no further analysis needed
clamp.js	safe	Cleared by Jev triage; no further analysis needed
clone.js	safe	Cleared by Jev triage; no further analysis needed
cloneDeep.js	safe	Cleared by Jev triage; no further analysis needed
cloneDeepWith.js	safe	Cleared by Jev triage; no further analysis needed
cloneWith.js	safe	Cleared by Jev triage; no further analysis needed
collection.default.js	safe	Cleared by Jev triage; no further analysis needed
collection.js	safe	Cleared by Jev triage; no further analysis needed
commit.js	safe	Cleared by Jev triage; no further analysis needed
compact.js	safe	Cleared by Jev triage; no further analysis needed
concat.js	safe	Cleared by Jev triage; no further analysis needed
cond.js	safe	Cleared by Jev triage; no further analysis needed
conforms.js	safe	Cleared by Jev triage; no further analysis needed
conformsTo.js	safe	Cleared by Jev triage; no further analysis needed
constant.js	safe	Cleared by Jev triage; no further analysis needed
countBy.js	safe	Cleared by Jev triage; no further analysis needed
create.js	safe	Cleared by Jev triage; no further analysis needed
curry.js	safe	Cleared by Jev triage; no further analysis needed
curryRight.js	safe	Cleared by Jev triage; no further analysis needed
date.default.js	safe	Cleared by Jev triage; no further analysis needed
date.js	safe	Cleared by Jev triage; no further analysis needed
debounce.js	safe	Cleared by Jev triage; no further analysis needed
deburr.js	safe	Cleared by Jev triage; no further analysis needed
defaultTo.js	safe	Cleared by Jev triage; no further analysis needed
defaults.js	safe	Cleared by Jev triage; no further analysis needed
defaultsDeep.js	safe	Cleared by Jev triage; no further analysis needed
defer.js	safe	Cleared by Jev triage; no further analysis needed
delay.js	safe	Cleared by Jev triage; no further analysis needed
difference.js	safe	Cleared by Jev triage; no further analysis needed
differenceBy.js	safe	Cleared by Jev triage; no further analysis needed
differenceWith.js	safe	Cleared by Jev triage; no further analysis needed
divide.js	safe	Cleared by Jev triage; no further analysis needed
drop.js	safe	Cleared by Jev triage; no further analysis needed
dropRight.js	safe	Cleared by Jev triage; no further analysis needed
dropRightWhile.js	safe	Cleared by Jev triage; no further analysis needed
dropWhile.js	safe	Cleared by Jev triage; no further analysis needed
each.js	safe	Cleared by Jev triage; no further analysis needed
eachRight.js	safe	Cleared by Jev triage; no further analysis needed
endsWith.js	safe	Cleared by Jev triage; no further analysis needed
entries.js	safe	Cleared by Jev triage; no further analysis needed
entriesIn.js	safe	Cleared by Jev triage; no further analysis needed
eq.js	safe	Cleared by Jev triage; no further analysis needed
escape.js	safe	Cleared by Jev triage; no further analysis needed
escapeRegExp.js	safe	Cleared by Jev triage; no further analysis needed
every.js	safe	Cleared by Jev triage; no further analysis needed
extend.js	safe	Cleared by Jev triage; no further analysis needed
extendWith.js	safe	Cleared by Jev triage; no further analysis needed
fill.js	safe	Cleared by Jev triage; no further analysis needed
filter.js	safe	Cleared by Jev triage; no further analysis needed
find.js	safe	Cleared by Jev triage; no further analysis needed
findIndex.js	safe	Cleared by Jev triage; no further analysis needed
findKey.js	safe	Cleared by Jev triage; no further analysis needed
findLast.js	safe	Cleared by Jev triage; no further analysis needed
findLastIndex.js	safe	Cleared by Jev triage; no further analysis needed
findLastKey.js	safe	Cleared by Jev triage; no further analysis needed
first.js	safe	Cleared by Jev triage; no further analysis needed
flatMap.js	safe	Cleared by Jev triage; no further analysis needed
flatMapDeep.js	safe	Cleared by Jev triage; no further analysis needed
flatMapDepth.js	safe	Cleared by Jev triage; no further analysis needed
flatten.js	safe	Cleared by Jev triage; no further analysis needed
flattenDeep.js	safe	Cleared by Jev triage; no further analysis needed
flattenDepth.js	safe	Cleared by Jev triage; no further analysis needed
flip.js	safe	Cleared by Jev triage; no further analysis needed
floor.js	safe	Cleared by Jev triage; no further analysis needed
flow.js	safe	Cleared by Jev triage; no further analysis needed
flowRight.js	safe	Cleared by Jev triage; no further analysis needed
forEach.js	safe	Cleared by Jev triage; no further analysis needed
forEachRight.js	safe	Cleared by Jev triage; no further analysis needed
forIn.js	safe	Cleared by Jev triage; no further analysis needed
forInRight.js	safe	Cleared by Jev triage; no further analysis needed
forOwn.js	safe	Cleared by Jev triage; no further analysis needed
forOwnRight.js	safe	Cleared by Jev triage; no further analysis needed
fromPairs.js	safe	Cleared by Jev triage; no further analysis needed
function.default.js	safe	Cleared by Jev triage; no further analysis needed
function.js	safe	Cleared by Jev triage; no further analysis needed
functions.js	safe	Cleared by Jev triage; no further analysis needed
functionsIn.js	safe	Cleared by Jev triage; no further analysis needed
get.js	safe	Cleared by Jev triage; no further analysis needed
groupBy.js	safe	Cleared by Jev triage; no further analysis needed
gt.js	safe	Cleared by Jev triage; no further analysis needed
gte.js	safe	Cleared by Jev triage; no further analysis needed
has.js	safe	Cleared by Jev triage; no further analysis needed
hasIn.js	safe	Cleared by Jev triage; no further analysis needed
head.js	safe	Cleared by Jev triage; no further analysis needed
identity.js	safe	Cleared by Jev triage; no further analysis needed
inRange.js	safe	Cleared by Jev triage; no further analysis needed
includes.js	safe	Cleared by Jev triage; no further analysis needed
indexOf.js	safe	Cleared by Jev triage; no further analysis needed
initial.js	safe	Cleared by Jev triage; no further analysis needed
intersection.js	safe	Cleared by Jev triage; no further analysis needed
intersectionBy.js	safe	Cleared by Jev triage; no further analysis needed
intersectionWith.js	safe	Cleared by Jev triage; no further analysis needed
invert.js	safe	Cleared by Jev triage; no further analysis needed
invertBy.js	safe	Cleared by Jev triage; no further analysis needed
invoke.js	safe	Cleared by Jev triage; no further analysis needed
invokeMap.js	safe	Cleared by Jev triage; no further analysis needed
isArguments.js	safe	No malicious patterns detected
isArray.js	safe	Cleared by Jev triage; no further analysis needed
isArrayBuffer.js	safe	Cleared by Jev triage; no further analysis needed
isArrayLike.js	safe	Cleared by Jev triage; no further analysis needed
isArrayLikeObject.js	safe	Cleared by Jev triage; no further analysis needed
isBoolean.js	safe	Cleared by Jev triage; no further analysis needed
isBuffer.js	safe	Cleared by Jev triage; no further analysis needed
isDate.js	safe	Cleared by Jev triage; no further analysis needed
isElement.js	safe	Cleared by Jev triage; no further analysis needed
isEmpty.js	safe	Cleared by Jev triage; no further analysis needed
isEqual.js	safe	Cleared by Jev triage; no further analysis needed
isEqualWith.js	safe	Cleared by Jev triage; no further analysis needed
isError.js	safe	Cleared by Jev triage; no further analysis needed
isFinite.js	safe	Cleared by Jev triage; no further analysis needed
isFunction.js	safe	Cleared by Jev triage; no further analysis needed
isInteger.js	safe	Cleared by Jev triage; no further analysis needed
isLength.js	safe	Cleared by Jev triage; no further analysis needed
isMap.js	safe	Cleared by Jev triage; no further analysis needed
isMatch.js	safe	Cleared by Jev triage; no further analysis needed
isMatchWith.js	safe	Cleared by Jev triage; no further analysis needed
isNaN.js	safe	Cleared by Jev triage; no further analysis needed
isNative.js	safe	Cleared by Jev triage; no further analysis needed
isNil.js	safe	Cleared by Jev triage; no further analysis needed
isNull.js	safe	Cleared by Jev triage; no further analysis needed
isNumber.js	safe	Cleared by Jev triage; no further analysis needed
isObject.js	safe	Cleared by Jev triage; no further analysis needed
isObjectLike.js	safe	Cleared by Jev triage; no further analysis needed
isPlainObject.js	safe	Cleared by Jev triage; no further analysis needed
isRegExp.js	safe	Cleared by Jev triage; no further analysis needed
isSafeInteger.js	safe	Cleared by Jev triage; no further analysis needed
isSet.js	safe	Cleared by Jev triage; no further analysis needed
isString.js	safe	Cleared by Jev triage; no further analysis needed
isSymbol.js	safe	Cleared by Jev triage; no further analysis needed
isTypedArray.js	safe	Cleared by Jev triage; no further analysis needed
isUndefined.js	safe	Cleared by Jev triage; no further analysis needed
isWeakMap.js	safe	Cleared by Jev triage; no further analysis needed
isWeakSet.js	safe	Cleared by Jev triage; no further analysis needed
iteratee.js	safe	Cleared by Jev triage; no further analysis needed
join.js	safe	Cleared by Jev triage; no further analysis needed
kebabCase.js	safe	Cleared by Jev triage; no further analysis needed
keyBy.js	safe	Cleared by Jev triage; no further analysis needed
keys.js	safe	Cleared by Jev triage; no further analysis needed
keysIn.js	safe	Cleared by Jev triage; no further analysis needed
lang.default.js	safe	Cleared by Jev triage; no further analysis needed
lang.js	safe	Cleared by Jev triage; no further analysis needed
last.js	safe	Cleared by Jev triage; no further analysis needed
lastIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
lodash.default.js	safe	This is the standard lodash 4.18.1 main entry point file containing only legitimate library initialization and no malicious patterns.
lodash.js	safe	No malicious patterns detected; this is a standard lodash ES module export index file.
lowerCase.js	safe	Cleared by Jev triage; no further analysis needed
lowerFirst.js	safe	Cleared by Jev triage; no further analysis needed
lt.js	safe	Cleared by Jev triage; no further analysis needed
lte.js	safe	Cleared by Jev triage; no further analysis needed
map.js	safe	Cleared by Jev triage; no further analysis needed
mapKeys.js	safe	Cleared by Jev triage; no further analysis needed
mapValues.js	safe	Cleared by Jev triage; no further analysis needed
matches.js	safe	Cleared by Jev triage; no further analysis needed
matchesProperty.js	safe	Cleared by Jev triage; no further analysis needed
math.default.js	safe	Cleared by Jev triage; no further analysis needed
math.js	safe	Cleared by Jev triage; no further analysis needed
max.js	safe	Cleared by Jev triage; no further analysis needed
maxBy.js	safe	Cleared by Jev triage; no further analysis needed
mean.js	safe	Cleared by Jev triage; no further analysis needed
meanBy.js	safe	Cleared by Jev triage; no further analysis needed
memoize.js	safe	Cleared by Jev triage; no further analysis needed
merge.js	safe	Cleared by Jev triage; no further analysis needed
mergeWith.js	safe	Cleared by Jev triage; no further analysis needed
method.js	safe	Cleared by Jev triage; no further analysis needed
methodOf.js	safe	Cleared by Jev triage; no further analysis needed
min.js	safe	Cleared by Jev triage; no further analysis needed
minBy.js	safe	Cleared by Jev triage; no further analysis needed
mixin.js	safe	This is a legitimate lodash mixin utility; no malicious patterns detected.
multiply.js	safe	Cleared by Jev triage; no further analysis needed
negate.js	safe	Cleared by Jev triage; no further analysis needed
next.js	safe	Cleared by Jev triage; no further analysis needed
noop.js	safe	Cleared by Jev triage; no further analysis needed
now.js	safe	Cleared by Jev triage; no further analysis needed
nth.js	safe	Cleared by Jev triage; no further analysis needed
nthArg.js	safe	Cleared by Jev triage; no further analysis needed
number.default.js	safe	Cleared by Jev triage; no further analysis needed
number.js	safe	Cleared by Jev triage; no further analysis needed
object.default.js	safe	Cleared by Jev triage; no further analysis needed
object.js	safe	Cleared by Jev triage; no further analysis needed
omit.js	safe	Cleared by Jev triage; no further analysis needed
omitBy.js	safe	Cleared by Jev triage; no further analysis needed
once.js	safe	Cleared by Jev triage; no further analysis needed
orderBy.js	safe	Cleared by Jev triage; no further analysis needed
over.js	safe	Cleared by Jev triage; no further analysis needed
overArgs.js	safe	Cleared by Jev triage; no further analysis needed
overEvery.js	safe	Cleared by Jev triage; no further analysis needed
overSome.js	safe	Cleared by Jev triage; no further analysis needed
pad.js	safe	Cleared by Jev triage; no further analysis needed
padEnd.js	safe	Cleared by Jev triage; no further analysis needed
padStart.js	safe	Cleared by Jev triage; no further analysis needed
parseInt.js	safe	Cleared by Jev triage; no further analysis needed
partial.js	safe	Cleared by Jev triage; no further analysis needed
partialRight.js	safe	Cleared by Jev triage; no further analysis needed
partition.js	safe	Cleared by Jev triage; no further analysis needed
pick.js	safe	Cleared by Jev triage; no further analysis needed
pickBy.js	safe	Cleared by Jev triage; no further analysis needed
plant.js	safe	Cleared by Jev triage; no further analysis needed
property.js	safe	Cleared by Jev triage; no further analysis needed
propertyOf.js	safe	Cleared by Jev triage; no further analysis needed
pull.js	safe	Cleared by Jev triage; no further analysis needed
pullAll.js	safe	Cleared by Jev triage; no further analysis needed
pullAllBy.js	safe	Cleared by Jev triage; no further analysis needed
pullAllWith.js	safe	Cleared by Jev triage; no further analysis needed
pullAt.js	safe	Cleared by Jev triage; no further analysis needed
random.js	safe	Cleared by Jev triage; no further analysis needed
range.js	safe	Cleared by Jev triage; no further analysis needed
rangeRight.js	safe	Cleared by Jev triage; no further analysis needed
rearg.js	safe	Cleared by Jev triage; no further analysis needed
reduce.js	safe	Cleared by Jev triage; no further analysis needed
reduceRight.js	safe	Cleared by Jev triage; no further analysis needed
reject.js	safe	Cleared by Jev triage; no further analysis needed
remove.js	safe	Cleared by Jev triage; no further analysis needed
repeat.js	safe	Cleared by Jev triage; no further analysis needed
replace.js	safe	Cleared by Jev triage; no further analysis needed
rest.js	safe	Cleared by Jev triage; no further analysis needed
result.js	safe	No malicious patterns detected
reverse.js	safe	Cleared by Jev triage; no further analysis needed
round.js	safe	Cleared by Jev triage; no further analysis needed
sample.js	safe	Cleared by Jev triage; no further analysis needed
sampleSize.js	safe	Cleared by Jev triage; no further analysis needed
seq.default.js	safe	Cleared by Jev triage; no further analysis needed
seq.js	safe	Cleared by Jev triage; no further analysis needed
set.js	safe	Cleared by Jev triage; no further analysis needed
setWith.js	safe	Cleared by Jev triage; no further analysis needed
shuffle.js	safe	Cleared by Jev triage; no further analysis needed
size.js	safe	Cleared by Jev triage; no further analysis needed
slice.js	safe	Cleared by Jev triage; no further analysis needed
snakeCase.js	safe	Cleared by Jev triage; no further analysis needed
some.js	safe	Cleared by Jev triage; no further analysis needed
sortBy.js	safe	Cleared by Jev triage; no further analysis needed
sortedIndex.js	safe	Cleared by Jev triage; no further analysis needed
sortedIndexBy.js	safe	Cleared by Jev triage; no further analysis needed
sortedIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
sortedLastIndex.js	safe	Cleared by Jev triage; no further analysis needed
sortedLastIndexBy.js	safe	Cleared by Jev triage; no further analysis needed
sortedLastIndexOf.js	safe	Cleared by Jev triage; no further analysis needed
sortedUniq.js	safe	Cleared by Jev triage; no further analysis needed
sortedUniqBy.js	safe	Cleared by Jev triage; no further analysis needed
split.js	safe	Cleared by Jev triage; no further analysis needed
spread.js	safe	Cleared by Jev triage; no further analysis needed
startCase.js	safe	Cleared by Jev triage; no further analysis needed
startsWith.js	safe	Cleared by Jev triage; no further analysis needed
string.default.js	safe	Cleared by Jev triage; no further analysis needed
string.js	safe	Cleared by Jev triage; no further analysis needed
stubArray.js	safe	Cleared by Jev triage; no further analysis needed
stubFalse.js	safe	Cleared by Jev triage; no further analysis needed
stubObject.js	safe	Cleared by Jev triage; no further analysis needed
stubString.js	safe	Cleared by Jev triage; no further analysis needed
stubTrue.js	safe	Cleared by Jev triage; no further analysis needed
subtract.js	safe	Cleared by Jev triage; no further analysis needed
sum.js	safe	Cleared by Jev triage; no further analysis needed
sumBy.js	safe	Cleared by Jev triage; no further analysis needed
tail.js	safe	Cleared by Jev triage; no further analysis needed
take.js	safe	Cleared by Jev triage; no further analysis needed
takeRight.js	safe	Cleared by Jev triage; no further analysis needed
takeRightWhile.js	safe	Cleared by Jev triage; no further analysis needed
takeWhile.js	safe	Cleared by Jev triage; no further analysis needed
tap.js	safe	Cleared by Jev triage; no further analysis needed
templateSettings.js	safe	Cleared by Jev triage; no further analysis needed
throttle.js	safe	Cleared by Jev triage; no further analysis needed
thru.js	safe	Cleared by Jev triage; no further analysis needed
times.js	safe	Cleared by Jev triage; no further analysis needed
toArray.js	safe	Cleared by Jev triage; no further analysis needed
toFinite.js	safe	Cleared by Jev triage; no further analysis needed
toInteger.js	safe	Cleared by Jev triage; no further analysis needed
toIterator.js	safe	Cleared by Jev triage; no further analysis needed
toJSON.js	safe	Cleared by Jev triage; no further analysis needed
toLength.js	safe	Cleared by Jev triage; no further analysis needed
toLower.js	safe	Cleared by Jev triage; no further analysis needed
toNumber.js	safe	Cleared by Jev triage; no further analysis needed
toPairs.js	safe	Cleared by Jev triage; no further analysis needed
toPairsIn.js	safe	Cleared by Jev triage; no further analysis needed
toPath.js	safe	Cleared by Jev triage; no further analysis needed
toPlainObject.js	safe	Cleared by Jev triage; no further analysis needed
toSafeInteger.js	safe	Cleared by Jev triage; no further analysis needed
toString.js	safe	Cleared by Jev triage; no further analysis needed
toUpper.js	safe	Cleared by Jev triage; no further analysis needed
transform.js	safe	Cleared by Jev triage; no further analysis needed
trim.js	safe	Cleared by Jev triage; no further analysis needed
trimEnd.js	safe	Cleared by Jev triage; no further analysis needed
trimStart.js	safe	Cleared by Jev triage; no further analysis needed
truncate.js	safe	Cleared by Jev triage; no further analysis needed
unary.js	safe	Cleared by Jev triage; no further analysis needed
unescape.js	safe	Cleared by Jev triage; no further analysis needed
union.js	safe	Cleared by Jev triage; no further analysis needed
unionBy.js	safe	Cleared by Jev triage; no further analysis needed
unionWith.js	safe	Cleared by Jev triage; no further analysis needed
uniq.js	safe	Cleared by Jev triage; no further analysis needed
uniqBy.js	safe	Cleared by Jev triage; no further analysis needed
uniqWith.js	safe	Cleared by Jev triage; no further analysis needed
uniqueId.js	safe	Cleared by Jev triage; no further analysis needed
unset.js	safe	Cleared by Jev triage; no further analysis needed
unzip.js	safe	Cleared by Jev triage; no further analysis needed
unzipWith.js	safe	Cleared by Jev triage; no further analysis needed
update.js	safe	Cleared by Jev triage; no further analysis needed
updateWith.js	safe	Cleared by Jev triage; no further analysis needed
upperCase.js	safe	Cleared by Jev triage; no further analysis needed
upperFirst.js	safe	Cleared by Jev triage; no further analysis needed
util.default.js	safe	Cleared by Jev triage; no further analysis needed
util.js	safe	Cleared by Jev triage; no further analysis needed
value.js	safe	Cleared by Jev triage; no further analysis needed
valueOf.js	safe	Cleared by Jev triage; no further analysis needed
values.js	safe	Cleared by Jev triage; no further analysis needed
valuesIn.js	safe	Cleared by Jev triage; no further analysis needed
without.js	safe	Cleared by Jev triage; no further analysis needed
words.js	safe	Cleared by Jev triage; no further analysis needed
wrap.js	safe	Cleared by Jev triage; no further analysis needed
wrapperAt.js	safe	Cleared by Jev triage; no further analysis needed
wrapperChain.js	safe	Cleared by Jev triage; no further analysis needed
wrapperLodash.js	safe	Cleared by Jev triage; no further analysis needed
wrapperReverse.js	safe	Cleared by Jev triage; no further analysis needed
wrapperValue.js	safe	Cleared by Jev triage; no further analysis needed
xor.js	safe	Cleared by Jev triage; no further analysis needed
xorBy.js	safe	Cleared by Jev triage; no further analysis needed
xorWith.js	safe	Cleared by Jev triage; no further analysis needed
zip.js	safe	Cleared by Jev triage; no further analysis needed
zipObject.js	safe	Cleared by Jev triage; no further analysis needed
zipObjectDeep.js	safe	Cleared by Jev triage; no further analysis needed
zipWith.js	safe	Cleared by Jev triage; no further analysis needed

Frequently asked questions

Is lodash-es safe to use?

No confirmed malware was found in lodash-es@4.18.1, but the review flagged 2 medium, 3 low severity findings for risky patterns worth checking before you rely on it.

Does lodash-es contain malware?

No malware was identified in lodash-es@4.18.1 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.

How was lodash-es checked?

Togoder Security downloaded the published npm package and had an AI model read its 644 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.

How do I scan lodash-es together with the rest of my dependencies?

Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in lodash-es@4.18.1, cost nothing.

lodash-es@4.18.1 security report

Summary

Findings 5

Source code generation

Dynamic code execution

Prototype pollution protection

Dynamic code execution

Insecure documentation warning

Files reviewed

Frequently asked questions

Related security reports