# lodash@4.17.21 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:54:46.000Z
- Files reviewed: 1044
- Findings: 1 high, 2 low severity findings
- Report: https://security.togoder.click/npm/lodash@4.17.21
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package lodash@4.17.21 on Oct 4, 2026. An AI review of 1044 source files produced 1 high, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [high] Dynamic Code Execution (eval-like)

Finding ID: `NPS-EFAF9BB4D8F4`

File: `template.js`

The template function constructs a JavaScript function body from user-supplied template strings and options, then compiles it via `Function(importsKeys, sourceURL + 'return ' + source)`. This is the intended core behavior of lodash's `_.template` (a documented feature), but it is inherently a dynamic code-execution primitive. If an attacker can control the template string, options.interpolate/escape/evaluate regexes, or options.variable, they can achieve arbitrary JavaScript execution. Note the presence of the `reForbiddenIdentifierChars` guard which blocks characters like `()=,{}[]/` and whitespace in the `variable` option to prevent command injection via the function parameter list.

### [low] dynamic code execution

Finding ID: `NPS-8B82729E1C3D`

File: `_root.js:7`

Uses Function('return this')() as a fallback to obtain the global object. While this is a common idiom in libraries like Lodash for environment detection, the 'new Function' constructor executes a string as code and can be flagged by static analyzers or CSP policies. In this specific context it is not malicious (it returns the global object), but it constitutes a dynamic code execution pattern that should be noted.

### [low] with Statement Usage

Finding ID: `NPS-03FB6F42ABA7`

File: `template.js`

When the `variable` option is not supplied, the compiled source is wrapped in `with (obj) { ... }`. This is intentional (to allow data properties as free variables) but is a known pattern that can lead to prototype pollution-style scope manipulation and makes static analysis harder. Not malicious on its own.

## Files reviewed

- `_root.js` (medium): This appears to be a standard Lodash-style global object detection helper with no exfiltration, credential harvesting, or network activity, but it uses the Function constructor which is a dynamic code execution pattern worth noting.
- `template.js` (medium): This is the official lodash `_.template` implementation, which intentionally compiles templates into functions via `new Function`; the dynamic code execution is a documented, guarded feature rather than an injected backdoor, but it carries inherent RCE risk if template inputs are attacker-controlled.
- `_DataView.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Hash.js` (safe): Cleared by Jev triage; no further analysis needed
- `_LazyWrapper.js` (safe): Cleared by Jev triage; no further analysis needed
- `_ListCache.js` (safe): Cleared by Jev triage; no further analysis needed
- `_LodashWrapper.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Map.js` (safe): Cleared by Jev triage; no further analysis needed
- `_MapCache.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Promise.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Set.js` (safe): Cleared by Jev triage; no further analysis needed
- `_SetCache.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Stack.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Symbol.js` (safe): Cleared by Jev triage; no further analysis needed
- `_Uint8Array.js` (safe): Cleared by Jev triage; no further analysis needed
- `_WeakMap.js` (safe): Cleared by Jev triage; no further analysis needed
- `_apply.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayAggregator.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayEach.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayEachRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayEvery.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayFilter.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayIncludes.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayIncludesWith.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayLikeKeys.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayMap.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayPush.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayReduce.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayReduceRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arraySample.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arraySampleSize.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arrayShuffle.js` (safe): Cleared by Jev triage; no further analysis needed
- `_arraySome.js` (safe): Cleared by Jev triage; no further analysis needed
- `_asciiSize.js` (safe): Cleared by Jev triage; no further analysis needed
- `_asciiToArray.js` (safe): Cleared by Jev triage; no further analysis needed
- `_asciiWords.js` (safe): Cleared by Jev triage; no further analysis needed
- `_assignMergeValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `_assignValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `_assocIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseAggregator.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseAssign.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseAssignValue.js` (safe): No malicious patterns detected; the code is a standard Lodash internal helper for safe property assignment.
- `_baseAt.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseClamp.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseClone.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseConforms.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseConformsTo.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseCreate.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseDelay.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseDifference.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseEach.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseEachRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseEvery.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseExtremum.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFill.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFilter.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFindIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFindKey.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFlatten.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFor.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseForOwn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseForOwnRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseForRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseFunctions.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseGet.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseGetAllKeys.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseGetTag.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseGt.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseHas.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseHasIn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseInRange.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIndexOfWith.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIntersection.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseInverter.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseInvoke.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsArguments.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsDate.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsEqual.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsEqualDeep.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsMap.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsMatch.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsNaN.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsNative.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsRegExp.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsSet.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIsTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseIteratee.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseKeys.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseKeysIn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseLodash.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseLt.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMap.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMatches.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMatchesProperty.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMean.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMerge.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseMergeDeep.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseNth.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseOrderBy.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePick.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePickBy.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseProperty.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePropertyDeep.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePropertyOf.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePullAll.js` (safe): Cleared by Jev triage; no further analysis needed
- `_basePullAt.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseRandom.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseRange.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseReduce.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseRepeat.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseRest.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSample.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSampleSize.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSet.js` (safe): No malicious patterns detected
- `_baseSetData.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSetToString.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseShuffle.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSlice.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSome.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSortBy.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSortedIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSortedIndexBy.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSortedUniq.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseSum.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseTimes.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseToNumber.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseToPairs.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseToString.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseTrim.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseUnary.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseUniq.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseUnset.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseUpdate.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseValues.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseWhile.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseWrapperValue.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseXor.js` (safe): Cleared by Jev triage; no further analysis needed
- `_baseZipObject.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cacheHas.js` (safe): Cleared by Jev triage; no further analysis needed
- `_castArrayLikeObject.js` (safe): Cleared by Jev triage; no further analysis needed
- `_castFunction.js` (safe): Cleared by Jev triage; no further analysis needed
- `_castPath.js` (safe): Cleared by Jev triage; no further analysis needed
- `_castRest.js` (safe): Cleared by Jev triage; no further analysis needed
- `_castSlice.js` (safe): Cleared by Jev triage; no further analysis needed
- `_charsEndIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `_charsStartIndex.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneBuffer.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneDataView.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneRegExp.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneSymbol.js` (safe): Cleared by Jev triage; no further analysis needed
- `_cloneTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed
- `_compareAscending.js` (safe): Cleared by Jev triage; no further analysis needed
- `_compareMultiple.js` (safe): Cleared by Jev triage; no further analysis needed
- `_composeArgs.js` (safe): Cleared by Jev triage; no further analysis needed
- `_composeArgsRight.js` (safe): Cleared by Jev triage; no further analysis needed
- `_copyArray.js` (safe): Cleared by Jev triage; no further analysis needed
- `_copyObject.js` (safe): Cleared by Jev triage; no further analysis needed
- `_copySymbols.js` (safe): Cleared by Jev triage; no further analysis needed
- `_copySymbolsIn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_coreJsData.js` (safe): Cleared by Jev triage; no further analysis needed
- `_countHolders.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createAggregator.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createAssigner.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createBaseEach.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createBaseFor.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createBind.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createCaseFirst.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createCompounder.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createCtor.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createCurry.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createFind.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createFlow.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createHybrid.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createInverter.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createMathOperation.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createOver.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createPadding.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createPartial.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createRange.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createRecurry.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createRelationalOperation.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createRound.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createSet.js` (safe): No malicious patterns detected
- `_createToPairs.js` (safe): Cleared by Jev triage; no further analysis needed
- `_createWrap.js` (safe): Cleared by Jev triage; no further analysis needed
- `_customDefaultsAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed
- `_customDefaultsMerge.js` (safe): Cleared by Jev triage; no further analysis needed
- `_customOmitClone.js` (safe): Cleared by Jev triage; no further analysis needed
- `_deburrLetter.js` (safe): Cleared by Jev triage; no further analysis needed
- `_defineProperty.js` (safe): No malicious patterns detected; this is a standard lodash utility module that safely retrieves Object.defineProperty.
- `_equalArrays.js` (safe): Cleared by Jev triage; no further analysis needed
- `_equalByTag.js` (safe): Cleared by Jev triage; no further analysis needed
- `_equalObjects.js` (safe): Cleared by Jev triage; no further analysis needed
- `_escapeHtmlChar.js` (safe): Cleared by Jev triage; no further analysis needed
- `_escapeStringChar.js` (safe): Cleared by Jev triage; no further analysis needed
- `_flatRest.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 2 scanned versions of lodash are flagged high or critical. The latest scanned version, 4.18.1, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 4.17.21 – 4.18.1 (`>=4.17.21 <=4.18.1`): medium (Dynamic Code Execution (eval-like) +1 more)

## Scanned versions

- [4.18.1](https://security.togoder.click/npm/lodash@4.18.1): medium, 2026-10-04T21:27:29.000Z
- [4.17.21](https://security.togoder.click/npm/lodash@4.17.21): medium, 2026-10-04T16:54:46.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology