npm / lodash / 4.18.1

lodash 4.18.1

Source

https://github.com/lodash/lodash

Commit scanned

4f0b76e2eca1 (recorded by npm)

Compared with

0c9b60c1ae26 (0 signals introduced since)

Files

1048 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 52 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 20:04

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-surrogate _hasUnicode.js:2:23

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

2. info unicode-surrogate _hasUnicode.js:2:31

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

3. info unicode-surrogate _unicodeSize.js:2:23

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

4. info unicode-surrogate _unicodeSize.js:2:31

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

5. info unicode-surrogate _unicodeSize.js:12:16

   orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

6. info unicode-surrogate _unicodeSize.js:12:24

   orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

7. info unicode-surrogate _unicodeSize.js:12:32

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

8. info unicode-surrogate _unicodeSize.js:15:23

   orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

       rsNonAstral = '[^' + rsAstralRange + ']',
       rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
       rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
       rsZWJ = '\\u200d';

9. info unicode-surrogate _unicodeSize.js:15:31

   orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

       rsNonAstral = '[^' + rsAstralRange + ']',
       rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
       rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
       rsZWJ = '\\u200d';

10. info unicode-surrogate _unicodeSize.js:15:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

11. info unicode-surrogate _unicodeSize.js:16:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

12. info unicode-surrogate _unicodeSize.js:16:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

13. info unicode-surrogate _unicodeSize.js:16:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

14. info unicode-surrogate _unicodeSize.js:16:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

15. info unicode-surrogate _unicodeToArray.js:2:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

16. info unicode-surrogate _unicodeToArray.js:2:31

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

17. info unicode-surrogate _unicodeToArray.js:12:16

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

18. info unicode-surrogate _unicodeToArray.js:12:24

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

19. info unicode-surrogate _unicodeToArray.js:12:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

20. info unicode-surrogate _unicodeToArray.js:15:23

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

21. info unicode-surrogate _unicodeToArray.js:15:31

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

22. info unicode-surrogate _unicodeToArray.js:15:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

23. info unicode-surrogate _unicodeToArray.js:16:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

24. info unicode-surrogate _unicodeToArray.js:16:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

25. info unicode-surrogate _unicodeToArray.js:16:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

26. info unicode-surrogate _unicodeToArray.js:16:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

27. info unicode-surrogate _unicodeWords.js:2:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

28. info unicode-surrogate _unicodeWords.js:2:31

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

29. info unicode-surrogate _unicodeWords.js:25:16

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

30. info unicode-surrogate _unicodeWords.js:25:24

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

31. info unicode-surrogate _unicodeWords.js:25:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

32. info unicode-surrogate _unicodeWords.js:28:23

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

33. info unicode-surrogate _unicodeWords.js:28:31

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

34. info unicode-surrogate _unicodeWords.js:28:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

35. info unicode-surrogate _unicodeWords.js:29:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

36. info unicode-surrogate _unicodeWords.js:29:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

37. info unicode-surrogate _unicodeWords.js:29:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

38. info unicode-surrogate _unicodeWords.js:29:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

39. info unicode-surrogate lodash.js:220:25

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

      /** Used to compose unicode character classes. */
      var rsAstralRange = '\\ud800-\\udfff',
          rsComboMarksRange = '\\u0300-\\u036f',
          reComboHalfMarksRange = '\\ufe20-\\ufe2f',

40. info unicode-surrogate lodash.js:220:33

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      /** Used to compose unicode character classes. */
      var rsAstralRange = '\\ud800-\\udfff',
          rsComboMarksRange = '\\u0300-\\u036f',
          reComboHalfMarksRange = '\\ufe20-\\ufe2f',

41. info unicode-surrogate lodash.js:244:18

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

42. info unicode-surrogate lodash.js:244:26

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

43. info unicode-surrogate lodash.js:244:34

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

44. info unicode-surrogate lodash.js:247:25

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

45. info unicode-surrogate lodash.js:247:33

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

46. info unicode-surrogate lodash.js:247:41

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

47. info unicode-surrogate lodash.js:248:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

48. info unicode-surrogate lodash.js:248:31

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

49. info unicode-surrogate lodash.js:248:40

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

50. info unicode-surrogate lodash.js:248:48

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

51. info critical → info by review dynamic-execution lodash.js:14992:16

    `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

          var result = attempt(function() {
            return Function(importsKeys, sourceURL + 'return ' + source)
              .apply(undefined, importsValues);
          });

    likely benign LLM, confidence 0.92 Lodash's _.template internals call Function(...) to compile template source into a callable function.

    Reasoning

    This is the internal template compiler in lodash, which builds a function from the template source via the Function constructor. That is the documented purpose of _.template and is a well-known legitimate pattern. The dynamic body is derived from developer-supplied template text, not from attacker-controlled network or install-time data, and nothing in the snippet suggests exfiltration or a dropper. The finding is accurate about the mechanism but benign in context.

52. info critical → info by review dynamic-execution template.js:271:12

    `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

      var result = attempt(function() {
        return Function(importsKeys, sourceURL + 'return ' + source)
          .apply(undefined, importsValues);
      });

    likely benign LLM, confidence 0.92 A copy of lodash's template compiler in template.js uses Function(...) to build a function from template source.

    Reasoning

    The snippet matches the same lodash template compilation logic as the lodash.js finding, with the same importsKeys/importsValues and sourceURL pattern. It is the standard way lodash turns template text into an executable function. There is no sign of obfuscation, hidden payload, or malicious data flow, so it reads as a legitimate, if dynamic, code-generation feature.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/lodash/lodash lodash && cd lodash
git checkout 4f0b76e2eca13de1c1fe8b4305abc1f7d63f4b86
disclude scan --severity info --diff 0c9b60c1ae2656ef0d605e6726d72307eb5c31ff .