# lodash@4.18.1 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-04T21:27:29.000Z - Files reviewed: 1044 - Findings: 1 medium, 1 low severity findings - Report: https://security.togoder.click/npm/lodash@4.18.1 - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package lodash@4.18.1 on Oct 4, 2026. An AI review of 1044 source files produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [medium] Dynamic Code Execution Finding ID: `NPS-4956E2B82D31` File: `template.js:273` The template function compiles arbitrary strings into executable JavaScript functions using the Function constructor. This is an intentional design feature of Lodash's `_.template` utility for creating compiled template functions from strings. While the code itself is the legitimate Lodash template implementation and includes safeguards (validating forbidden characters in variable and imports names, escaping string literals, normalizing sourceURL whitespace), the function inherently enables code execution if used with untrusted template strings. The documentation itself explicitly warns that `_.template` is insecure and should not be used with untrusted input. ### [low] dynamic code execution Finding ID: `NPS-8B82729E1C3D` File: `_root.js:7` Uses Function('return this')() as a fallback to obtain the global object. While this is a common idiom in libraries like Lodash for environment detection, the 'new Function' constructor executes a string as code and can be flagged by static analyzers or CSP policies. In this specific context it is not malicious (it returns the global object), but it constitutes a dynamic code execution pattern that should be noted. ## Files reviewed - `_root.js` (medium): This appears to be a standard Lodash-style global object detection helper with no exfiltration, credential harvesting, or network activity, but it uses the Function constructor which is a dynamic code execution pattern worth noting. - `template.js` (medium): This is the legitimate Lodash `_.template` source file; it uses the Function constructor to compile template strings into functions, which is an intentional but security-sensitive design explicitly documented as insecure for untrusted input, with no evidence of malicious exfiltration, credential harvesting, or backdoor behavior. - `_DataView.js` (safe): Cleared by Jev triage; no further analysis needed - `_Hash.js` (safe): Cleared by Jev triage; no further analysis needed - `_LazyWrapper.js` (safe): Cleared by Jev triage; no further analysis needed - `_ListCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_LodashWrapper.js` (safe): Cleared by Jev triage; no further analysis needed - `_Map.js` (safe): Cleared by Jev triage; no further analysis needed - `_MapCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_Promise.js` (safe): Cleared by Jev triage; no further analysis needed - `_Set.js` (safe): Cleared by Jev triage; no further analysis needed - `_SetCache.js` (safe): Cleared by Jev triage; no further analysis needed - `_Stack.js` (safe): Cleared by Jev triage; no further analysis needed - `_Symbol.js` (safe): Cleared by Jev triage; no further analysis needed - `_Uint8Array.js` (safe): Cleared by Jev triage; no further analysis needed - `_WeakMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_apply.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEachRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayEvery.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayFilter.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayIncludes.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayIncludesWith.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayLikeKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayPush.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayReduce.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayReduceRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySample.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySampleSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_arrayShuffle.js` (safe): Cleared by Jev triage; no further analysis needed - `_arraySome.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiToArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_asciiWords.js` (safe): Cleared by Jev triage; no further analysis needed - `_assignMergeValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_assignValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_assocIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssign.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseAssignValue.js` (safe): No malicious patterns detected; the code is a standard Lodash internal helper for safe property assignment. - `_baseAt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseClamp.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseClone.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseConforms.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseConformsTo.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseCreate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseDelay.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseDifference.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEachRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseEvery.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseExtremum.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFill.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFilter.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFindIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFindKey.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFlatten.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFor.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForOwn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForOwnRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseForRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseFunctions.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGet.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGetAllKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGetTag.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseGt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseHas.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseHasIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIndexOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIndexOfWith.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIntersection.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInverter.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseInvoke.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsArguments.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsDate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsEqual.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsEqualDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsMatch.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsNaN.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsNative.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsSet.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIsTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseIteratee.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseKeys.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseKeysIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseLodash.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseLt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMap.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMatches.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMatchesProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMean.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMerge.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseMergeDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseNth.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseOrderBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePick.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePickBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseProperty.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePropertyDeep.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePropertyOf.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePullAll.js` (safe): Cleared by Jev triage; no further analysis needed - `_basePullAt.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRandom.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseReduce.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRepeat.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseRest.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSample.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSampleSize.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSet.js` (safe): No malicious patterns detected - `_baseSetData.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSetToString.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseShuffle.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSlice.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSome.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedIndexBy.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSortedUniq.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseSum.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseTimes.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToNumber.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToPairs.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseToString.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseTrim.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUnary.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUniq.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseUnset.js` (safe): No malicious patterns detected; this is the standard Lodash `baseUnset` implementation with added prototype pollution safeguards. - `_baseUpdate.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseValues.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseWhile.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseWrapperValue.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseXor.js` (safe): Cleared by Jev triage; no further analysis needed - `_baseZipObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_cacheHas.js` (safe): Cleared by Jev triage; no further analysis needed - `_castArrayLikeObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_castFunction.js` (safe): Cleared by Jev triage; no further analysis needed - `_castPath.js` (safe): Cleared by Jev triage; no further analysis needed - `_castRest.js` (safe): Cleared by Jev triage; no further analysis needed - `_castSlice.js` (safe): Cleared by Jev triage; no further analysis needed - `_charsEndIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_charsStartIndex.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneArrayBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneBuffer.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneDataView.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneRegExp.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneSymbol.js` (safe): Cleared by Jev triage; no further analysis needed - `_cloneTypedArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_compareAscending.js` (safe): Cleared by Jev triage; no further analysis needed - `_compareMultiple.js` (safe): Cleared by Jev triage; no further analysis needed - `_composeArgs.js` (safe): Cleared by Jev triage; no further analysis needed - `_composeArgsRight.js` (safe): Cleared by Jev triage; no further analysis needed - `_copyArray.js` (safe): Cleared by Jev triage; no further analysis needed - `_copyObject.js` (safe): Cleared by Jev triage; no further analysis needed - `_copySymbols.js` (safe): Cleared by Jev triage; no further analysis needed - `_copySymbolsIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_coreJsData.js` (safe): Cleared by Jev triage; no further analysis needed - `_countHolders.js` (safe): Cleared by Jev triage; no further analysis needed - `_createAggregator.js` (safe): Cleared by Jev triage; no further analysis needed - `_createAssigner.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBaseEach.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBaseFor.js` (safe): Cleared by Jev triage; no further analysis needed - `_createBind.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCaseFirst.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCompounder.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCtor.js` (safe): Cleared by Jev triage; no further analysis needed - `_createCurry.js` (safe): Cleared by Jev triage; no further analysis needed - `_createFind.js` (safe): Cleared by Jev triage; no further analysis needed - `_createFlow.js` (safe): Cleared by Jev triage; no further analysis needed - `_createHybrid.js` (safe): Cleared by Jev triage; no further analysis needed - `_createInverter.js` (safe): Cleared by Jev triage; no further analysis needed - `_createMathOperation.js` (safe): Cleared by Jev triage; no further analysis needed - `_createOver.js` (safe): Cleared by Jev triage; no further analysis needed - `_createPadding.js` (safe): Cleared by Jev triage; no further analysis needed - `_createPartial.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRange.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRecurry.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRelationalOperation.js` (safe): Cleared by Jev triage; no further analysis needed - `_createRound.js` (safe): Cleared by Jev triage; no further analysis needed - `_createSet.js` (safe): No malicious patterns detected - `_createToPairs.js` (safe): Cleared by Jev triage; no further analysis needed - `_createWrap.js` (safe): Cleared by Jev triage; no further analysis needed - `_customDefaultsAssignIn.js` (safe): Cleared by Jev triage; no further analysis needed - `_customDefaultsMerge.js` (safe): Cleared by Jev triage; no further analysis needed - `_customOmitClone.js` (safe): Cleared by Jev triage; no further analysis needed - `_deburrLetter.js` (safe): Cleared by Jev triage; no further analysis needed - `_defineProperty.js` (safe): No malicious patterns detected; this is a standard lodash utility module that safely retrieves Object.defineProperty. - `_equalArrays.js` (safe): Cleared by Jev triage; no further analysis needed - `_equalByTag.js` (safe): Cleared by Jev triage; no further analysis needed - `_equalObjects.js` (safe): Cleared by Jev triage; no further analysis needed - `_escapeHtmlChar.js` (safe): Cleared by Jev triage; no further analysis needed - `_escapeStringChar.js` (safe): Cleared by Jev triage; no further analysis needed - `_flatRest.js` (safe): Cleared by Jev triage; no further analysis needed ## Version ranges None of the 2 scanned versions of lodash are flagged high or critical. The latest scanned version, 4.18.1, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered. - 4.17.21 – 4.18.1 (`>=4.17.21 <=4.18.1`): medium (Dynamic Code Execution (eval-like) +1 more) ## Scanned versions - [4.18.1](https://security.togoder.click/npm/lodash@4.18.1): medium, 2026-10-04T21:27:29.000Z - [4.17.21](https://security.togoder.click/npm/lodash@4.17.21): medium, 2026-10-04T16:54:46.000Z AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology