lodash/lodash free scan: 60 vulnerable dependencies, 0 committed secrets

lodash/lodash ↗ · 0843bd4 · Aug 21, 2026, 11:36 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

36 of 148 files scanned (24%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this means

Two scanners read 36 of 148 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

60 found · 37 packages · 60 devDependencies

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

dev depnpm brace-expansion3 in 1 version

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

dev depnpm dojo3 in 1 version

1.13.0 — GHSA-536q-8gxx-m782, GHSA-jxfh-8wgv-vfr2, GHSA-m8gw-hjpr-rjv7

Cross-Site Scripting in dojo — devDependency

Prototype pollution in dojo — devDependency

Prototype Pollution in dojo — devDependency

dev depnpm handlebars3 in 1 version

4.0.11 — GHSA-2cf5-4w76-r9qv, GHSA-2qvq-rjwj-gvw9, GHSA-2w6w-674q-4c4q

Arbitrary Code Execution in handlebars — devDependency

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection — devDependency

Handlebars.js has JavaScript Injection via AST Type Confusion — devDependency

dev depnpm jquery3 in 1 version

3.3.1 — GHSA-6c3j-c64m-qhgq, GHSA-gxr4-xjj5-5px2, GHSA-jpcq-cgw6-v4j6

XSS in jQuery as used in Drupal, Backdrop CMS, and other products — devDependency

Potential XSS vulnerability in jQuery — devDependency

dev depnpm js-yaml3 in 1 version

3.6.1 — GHSA-2pr6-76vf-7546, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

Denial of Service in js-yaml — devDependency

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

dev depnpm lodash3 in 1 version

4.17.3 — GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-4xc9-xhrj-v574

Regular Expression Denial of Service (ReDoS) in lodash — devDependency

Command Injection in lodash — devDependency

Prototype Pollution in lodash — devDependency

dev depnpm minimatch3 in 1 version

3.0.4 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency

dev depnpm qs3 in 1 version

1.2.2 — GHSA-6rw7-vpxm-498p, GHSA-gqgv-6jq5-jjj9, GHSA-hrpp-h998-j3pp

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — devDependency

Prototype Pollution Protection Bypass in qs — devDependency

qs vulnerable to Prototype Pollution — devDependency

dev depnpm ajv2 in 1 version

5.5.2 — GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw

ajv has ReDoS when using `$data` option — devDependency

Prototype Pollution in Ajv — devDependency

dev depnpm ecstatic2 in 1 version

2.2.1 — GHSA-9q64-mpxx-87fg, GHSA-jc84-3g44-wf2q

Open Redirect in ecstatic — devDependency

Denial of Service in ecstatic — devDependency

dev depnpm form-data2 in 1 version

0.1.4 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx

form-data uses unsafe random function in form-data for choosing boundary — devDependency

form-data: CRLF injection in form-data via unescaped multipart field names and filenames — devDependency

dev depnpm fsevents2 in 1 version

1.2.2 — GHSA-8r6j-v8pm-fqw3, MAL-2023-462

Code injection in fsevents — devDependency

Malicious code in fsevents (npm) — devDependency

dev depnpm hawk2 in 1 version

1.1.1 — GHSA-44pw-h2cw-w3vq, GHSA-jcpv-g9rr-qxrc

Uncontrolled Resource Consumption in Hawk — devDependency

Regular Expression Denial of Service in hawk — devDependency

dev depnpm hoek2 in 1 version

0.9.1 — GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm

hoek subject to prototype pollution via the clone function. — devDependency

Prototype Pollution in hoek — devDependency

dev depnpm minimist2 in 1 version

1.2.0 — GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h

Prototype Pollution in minimist — devDependency

dev depnpm async@2.6.0GHSA-fwr7-v2mv-hh25

Prototype Pollution in async — devDependency

dev depnpm babel-traverse@6.26.0GHSA-67hx-6x53-jw92

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — devDependency

dev depnpm bl@0.9.5GHSA-pp7h-53gx-mx7r

Remote Memory Exposure in bl — devDependency

dev depnpm braces@1.8.5GHSA-grv7-fg5c-xmjg

Uncontrolled resource consumption in braces — devDependency

dev depnpm cross-spawn@5.1.0GHSA-3xgq-45jj-v275

Regular Expression Denial of Service (ReDoS) in cross-spawn — devDependency

dev depnpm css-what@2.1.0GHSA-p28h-cc7q-c4fg

css-what vulnerable to ReDoS due to use of insecure regular expression — devDependency

dev depnpm extend@3.0.1GHSA-qrmc-fj45-qfc2

Prototype Pollution in extend — devDependency

dev depnpm hosted-git-info@2.6.0GHSA-43f8-2h32-f4cj

Regular Expression Denial of Service in hosted-git-info — devDependency

dev depnpm i@0.3.6GHSA-x55w-vjjp-222r

inflect vulnerable to Inefficient Regular Expression Complexity — devDependency

dev depnpm ini@1.3.5GHSA-qqgx-2p2h-9c37

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse — devDependency

dev depnpm json-schema@0.2.3GHSA-896r-f27r-55mw

json-schema is vulnerable to Prototype Pollution — devDependency

dev depnpm json5@0.5.1GHSA-9c47-m6qq-7p4h

Prototype Pollution in JSON5 via Parse Method — devDependency

dev depnpm jsonpointer@4.0.1GHSA-282f-qqgm-c34q

Prototype Pollution in node-jsonpointer — devDependency

dev depnpm loader-utils@0.2.17GHSA-76p3-8jx3-jpfq

Prototype pollution in webpack loader-utils — devDependency

dev depnpm lodash.merge@4.6.1GHSA-h726-x36v-rx45

Prototype Pollution in lodash.merge — devDependency

dev depnpm lodash.pick@4.4.0GHSA-p6mc-m468-83gw

Prototype Pollution in lodash — devDependency

dev depnpm micromatch@2.3.11GHSA-952p-6rrq-rcjv

Regular Expression Denial of Service (ReDoS) in micromatch — devDependency

dev depnpm mime@1.2.11GHSA-wrvr-8mpx-r7pp

mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input — devDependency

dev depnpm nth-check@1.0.1GHSA-rp65-9cf3-cjxr

Inefficient Regular Expression Complexity in nth-check — devDependency

dev depnpm path-parse@1.0.5GHSA-hj48-42vr-x3v9

Regular Expression Denial of Service in path-parse — devDependency

dev depnpm pathval@0.1.1GHSA-g6ww-v8xp-vmwg

Prototype pollution in pathval — devDependency

dev depnpm randomatic@1.1.7GHSA-6g33-f262-xjp4

Cryptographically Weak PRNG in randomatic — devDependency

AI audit · lodash/lodash · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 36 of 148 files · lodash/lodash
Dependency manifests: 1 package root found, 1 scanned.

README badge

[![nittim](https://nittim.com/api/badge/lodash/lodash)](https://nittim.com/library/lodash/lodash)