lodash/lodash · audit

lodash/lodash ↗ · a666ba5 · Aug 21, 2026, 10:43 PM

No deterministic issues foundNo problems found by this automatic checkNo issues found

Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only

The secret and dependency scanners surfaced nothing verdict-bearing in what they scanned. This is not a clean bill of health. These two scanners cover a sliver of production-readiness — the 14 dimensions that actually decide whether you ship are unaudited below. Run Audit for the verdict.

The checks for leaked passwords and known package bugs found nothing to flag. This does not mean your code is safe. These two checks cover only a small slice of what matters — the 14 areas that actually decide whether your code is ready to ship are not checked yet. Run Audit for the full verdict.

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

48 of 160 files scanned (30%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this meansWhat this means for youWhat this means

Two scanners read 48 of 160 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

60 found · 39 packages · 60 devDependencies

Test/example/doc credentials and devDependency or moderate/low CVEs. Surfaced as context — these never force the worst verdict.Passwords found in test, example or documentation files, and lower-severity security bugs in packages only used while building the project. Shown for context — these never cause the worst possible result.Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

dev depnpm brace-expansion3 in 1 version

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

dev depnpm handlebars3 in 1 version

4.1.2 — GHSA-2cf5-4w76-r9qv, GHSA-2qvq-rjwj-gvw9, GHSA-2w6w-674q-4c4q

Arbitrary Code Execution in handlebars — devDependency

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection — devDependency

Handlebars.js has JavaScript Injection via AST Type Confusion — devDependency

dev depnpm js-yaml3 in 1 version

3.13.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency

dev depnpm lodash3 in 1 version

4.17.20 — GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-f23m-r3pf-42rh

Regular Expression Denial of Service (ReDoS) in lodash — devDependency

Command Injection in lodash — devDependency

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — devDependency

dev depnpm minimatch3 in 1 version

3.0.4 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency

dev depnpm qs3 in 1 version

1.2.2 — GHSA-6rw7-vpxm-498p, GHSA-gqgv-6jq5-jjj9, GHSA-hrpp-h998-j3pp

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — devDependency

Prototype Pollution Protection Bypass in qs — devDependency

qs vulnerable to Prototype Pollution — devDependency

dev depnpm ajv2 in 1 version

6.10.2 — GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw

ajv has ReDoS when using `$data` option — devDependency

Prototype Pollution in Ajv — devDependency

dev depnpm dojo2 in 1 version

1.15.0 — GHSA-jxfh-8wgv-vfr2, GHSA-m8gw-hjpr-rjv7

Prototype pollution in dojo — devDependency

Prototype Pollution in dojo — devDependency

dev depnpm form-data2 in 1 version

0.1.4 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx

form-data uses unsafe random function in form-data for choosing boundary — devDependency

form-data: CRLF injection in form-data via unescaped multipart field names and filenames — devDependency

dev depnpm fsevents2 in 1 version

1.2.2 — GHSA-8r6j-v8pm-fqw3, MAL-2023-462

Code injection in fsevents — devDependency

Malicious code in fsevents (npm) — devDependency

dev depnpm hawk2 in 1 version

1.1.1 — GHSA-44pw-h2cw-w3vq, GHSA-jcpv-g9rr-qxrc

Uncontrolled Resource Consumption in Hawk — devDependency

Regular Expression Denial of Service in hawk — devDependency

dev depnpm hoek2 in 1 version

0.9.1 — GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm

hoek subject to prototype pollution via the clone function. — devDependency

Prototype Pollution in hoek — devDependency

dev depnpm jquery2 in 1 version

3.4.1 — GHSA-gxr4-xjj5-5px2, GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery — devDependency

dev depnpm minimist2 in 1 version

1.2.0 — GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h

Prototype Pollution in minimist — devDependency

dev depnpm tar2 in 1 version

4.4.10 — GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v

node-tar: Decompression/parse DoS via unlimited input — devDependency

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal — devDependency

dev depnpm async@2.6.3GHSA-fwr7-v2mv-hh25

Prototype Pollution in async — devDependency

dev depnpm babel-traverse@6.26.0GHSA-67hx-6x53-jw92

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — devDependency

dev depnpm bl@0.9.5GHSA-pp7h-53gx-mx7r

Remote Memory Exposure in bl — devDependency

dev depnpm braces@1.8.5GHSA-grv7-fg5c-xmjg

Uncontrolled resource consumption in braces — devDependency

dev depnpm cross-spawn@5.1.0GHSA-3xgq-45jj-v275

Regular Expression Denial of Service (ReDoS) in cross-spawn — devDependency

dev depnpm css-what@2.1.0GHSA-p28h-cc7q-c4fg

css-what vulnerable to ReDoS due to use of insecure regular expression — devDependency

dev depnpm ecstatic@2.2.2GHSA-jc84-3g44-wf2q

Denial of Service in ecstatic — devDependency

dev depnpm extend@3.0.1GHSA-qrmc-fj45-qfc2

Prototype Pollution in extend — devDependency

dev depnpm hosted-git-info@2.6.0GHSA-43f8-2h32-f4cj

Regular Expression Denial of Service in hosted-git-info — devDependency

dev depnpm i@0.3.6GHSA-x55w-vjjp-222r

inflect vulnerable to Inefficient Regular Expression Complexity — devDependency

dev depnpm ini@1.3.5GHSA-qqgx-2p2h-9c37

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse — devDependency

dev depnpm json-schema@0.2.3GHSA-896r-f27r-55mw

json-schema is vulnerable to Prototype Pollution — devDependency

dev depnpm json5@0.5.1GHSA-9c47-m6qq-7p4h

Prototype Pollution in JSON5 via Parse Method — devDependency

dev depnpm jsonpointer@4.0.1GHSA-282f-qqgm-c34q

Prototype Pollution in node-jsonpointer — devDependency

dev depnpm loader-utils@0.2.17GHSA-76p3-8jx3-jpfq

Prototype pollution in webpack loader-utils — devDependency

dev depnpm lodash.pick@4.4.0GHSA-p6mc-m468-83gw

Prototype Pollution in lodash — devDependency

dev depnpm micromatch@2.3.11GHSA-952p-6rrq-rcjv

Regular Expression Denial of Service (ReDoS) in micromatch — devDependency

dev depnpm nth-check@1.0.1GHSA-rp65-9cf3-cjxr

Inefficient Regular Expression Complexity in nth-check — devDependency

dev depnpm path-parse@1.0.5GHSA-hj48-42vr-x3v9

Regular Expression Denial of Service in path-parse — devDependency

dev depnpm pathval@0.1.1GHSA-g6ww-v8xp-vmwg

Prototype pollution in pathval — devDependency

dev depnpm request@2.88.0GHSA-p8p7-x288-28g6

Server-Side Request Forgery in Request — devDependency

dev depnpm requirejs@2.3.6GHSA-x3m3-4wpv-5vgc

jrburke requirejs vulnerable to prototype pollution — devDependency

dev depnpm semver@5.5.0GHSA-c2qf-rxjj-qqgw

semver vulnerable to Regular Expression Denial of Service — devDependency

dev depnpm sha.js@2.2.6GHSA-95m3-7q98-8xr5

sha.js is missing type checks leading to hash rewind and passing on crafted data — devDependency

AI audit for lodash/lodash · all 14 dimensions · usually within 15 minutes*AI check for lodash/lodash · all 14 areas · usually within 15 minutes*AI audit · lodash/lodash · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inNeeds a free sign-in with GitHub or GoogleNeeds a free GitHub or Google sign-inThe free scan stays unlimitedYou can run the free scan as many times as you likeThe free scan stays unlimited

14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited

Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.

The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 48 of 160 files · lodash/lodash
Dependency manifests: 1 package root found, 1 scanned.

README badgeBadge for your project's readme fileREADME badge

[![nittim](https://nittim.com/api/badge/lodash/lodash)](https://nittim.com)