lodash

4.18.1

npm / lodash / 4.18.1· requested latest

Scan ID

a80d4758-1…

Scanned

Oct 12, 2026, 3:40 PM

REVIEWManual review recommended

Scan summary

lodash@latest was inspected against npm metadata, its published tarball and OSV advisories, and returned REVIEW.

Recorded evidence

Verdict
REVIEW
Risk score
24/100
Findings
2
Signed by
3 local roles

Package code was never executed. Open the Threats tab for individual findings and the exact lines they matched.

REVIEW

lodash@latest

TypenpmSize—Published—

Risk Score

24/ 100

Summary

Risk score 24/100 under policy d0-policy/1.0.0. Installation is held for human review before execution. No published advisory matches this exact version. 2 static code patterns matched in the source. Three locally signed scanner roles reached REVIEW at quorum 3/3. The result is anchored and confirmed on Solana Devnet.

Scanner Consensus

  • 0Block
  • 1Review
  • 2Allow
Quorum3/3ResultreviewPolicyd0-consensus/1.0.0

1 scanner(s) returned REVIEW.

  • reviewstatic_lifecyclea5c7b61d4cdb…
  • allowdependency_advisory880fb0adaa2c…
  • allowartifact_integrityfff189949f9a…

Three analytical modules run on one machine under one operator. Their signatures prove internal consistency and tamper-evidence, not independent verification or decentralisation.

Key Threats

2
  • D0-SRC-003Executes a string as code

    Source passes data to eval, new Function, or equivalent dynamic execution. Paired with obfuscated string reconstruction, this indicates concealed execution.

    highmedium confidenceheuristic

    • package/_root.js:7

      var root = freeGlobal || freeSelf || Function('return this')();

    • package/core.js:71

      var root = freeGlobal || freeSelf || Function('return this')();

    • package/core.min.js:25

      "&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"},Et=typeof global=="object"&&global&&global.Object===Object&&global,Nt=typeof self=="object"&&self&&s…
  • D0-SRC-004Obfuscated execution chain

    Source reconstructs code at runtime from escaped or base64-decoded strings and then executes it. The reconstructed value is then executed dynamically.

    mediummedium confidenceheuristic

    • package/keyBy.js:25

      *   return String.fromCharCode(o.code);

On-chain Attestation

Network
devnet
Mechanism
Solana Devnet commitment anchored via Memo
Transaction
5JzG…FnLd
Slot
510311917
Commitment
a3ba712a18bc…
Status
Confirmed on Solana Devnet
View on ExplorerExport proof bundle

Dependency Graph

lodashlatest

Transitive dependencies appear once a scanner resolves this package.