npm / lodash / 4.18.1

lodash 4.18.1

Source

https://github.com/lodash/lodash

Commit scanned

4f0b76e2eca1 (recorded by npm)

Compared with

0c9b60c1ae26 (0 signals introduced since)

Files

1048 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 52 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 18:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-surrogate _hasUnicode.js:2:23

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

2. info unicode-surrogate _hasUnicode.js:2:31

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

3. info unicode-surrogate _unicodeSize.js:2:23

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

4. info unicode-surrogate _unicodeSize.js:2:31

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

   /** Used to compose unicode character classes. */
   var rsAstralRange = '\\ud800-\\udfff',
       rsComboMarksRange = '\\u0300-\\u036f',
       reComboHalfMarksRange = '\\ufe20-\\ufe2f',

5. info unicode-surrogate _unicodeSize.js:12:16

   orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

6. info unicode-surrogate _unicodeSize.js:12:24

   orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

7. info unicode-surrogate _unicodeSize.js:12:32

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

       rsCombo = '[' + rsComboRange + ']',
       rsFitz = '\\ud83c[\\udffb-\\udfff]',
       rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
       rsNonAstral = '[^' + rsAstralRange + ']',

8. info unicode-surrogate _unicodeSize.js:15:23

   orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

       rsNonAstral = '[^' + rsAstralRange + ']',
       rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
       rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
       rsZWJ = '\\u200d';

9. info unicode-surrogate _unicodeSize.js:15:31

   orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

       rsNonAstral = '[^' + rsAstralRange + ']',
       rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
       rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
       rsZWJ = '\\u200d';

10. info unicode-surrogate _unicodeSize.js:15:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

11. info unicode-surrogate _unicodeSize.js:16:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

12. info unicode-surrogate _unicodeSize.js:16:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

13. info unicode-surrogate _unicodeSize.js:16:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

14. info unicode-surrogate _unicodeSize.js:16:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

15. info unicode-surrogate _unicodeToArray.js:2:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

16. info unicode-surrogate _unicodeToArray.js:2:31

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

17. info unicode-surrogate _unicodeToArray.js:12:16

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

18. info unicode-surrogate _unicodeToArray.js:12:24

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

19. info unicode-surrogate _unicodeToArray.js:12:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsCombo = '[' + rsComboRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

20. info unicode-surrogate _unicodeToArray.js:15:23

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

21. info unicode-surrogate _unicodeToArray.js:15:31

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

22. info unicode-surrogate _unicodeToArray.js:15:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

23. info unicode-surrogate _unicodeToArray.js:16:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

24. info unicode-surrogate _unicodeToArray.js:16:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

25. info unicode-surrogate _unicodeToArray.js:16:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

26. info unicode-surrogate _unicodeToArray.js:16:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsZWJ = '\\u200d';

27. info unicode-surrogate _unicodeWords.js:2:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

28. info unicode-surrogate _unicodeWords.js:2:31

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    /** Used to compose unicode character classes. */
    var rsAstralRange = '\\ud800-\\udfff',
        rsComboMarksRange = '\\u0300-\\u036f',
        reComboHalfMarksRange = '\\ufe20-\\ufe2f',

29. info unicode-surrogate _unicodeWords.js:25:16

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

30. info unicode-surrogate _unicodeWords.js:25:24

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

31. info unicode-surrogate _unicodeWords.js:25:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
        rsFitz = '\\ud83c[\\udffb-\\udfff]',
        rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
        rsNonAstral = '[^' + rsAstralRange + ']',

32. info unicode-surrogate _unicodeWords.js:28:23

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

33. info unicode-surrogate _unicodeWords.js:28:31

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

34. info unicode-surrogate _unicodeWords.js:28:39

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsNonAstral = '[^' + rsAstralRange + ']',
        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',

35. info unicode-surrogate _unicodeWords.js:29:21

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

36. info unicode-surrogate _unicodeWords.js:29:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

37. info unicode-surrogate _unicodeWords.js:29:38

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

38. info unicode-surrogate _unicodeWords.js:29:46

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
        rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
        rsUpper = '[' + rsUpperRange + ']',
        rsZWJ = '\\u200d';

39. info unicode-surrogate lodash.js:220:25

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

      /** Used to compose unicode character classes. */
      var rsAstralRange = '\\ud800-\\udfff',
          rsComboMarksRange = '\\u0300-\\u036f',
          reComboHalfMarksRange = '\\ufe20-\\ufe2f',

40. info unicode-surrogate lodash.js:220:33

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      /** Used to compose unicode character classes. */
      var rsAstralRange = '\\ud800-\\udfff',
          rsComboMarksRange = '\\u0300-\\u036f',
          reComboHalfMarksRange = '\\ufe20-\\ufe2f',

41. info unicode-surrogate lodash.js:244:18

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

42. info unicode-surrogate lodash.js:244:26

    orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

43. info unicode-surrogate lodash.js:244:34

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
          rsFitz = '\\ud83c[\\udffb-\\udfff]',
          rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
          rsNonAstral = '[^' + rsAstralRange + ']',

44. info unicode-surrogate lodash.js:247:25

    orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

45. info unicode-surrogate lodash.js:247:33

    orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

46. info unicode-surrogate lodash.js:247:41

    orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsNonAstral = '[^' + rsAstralRange + ']',
          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',

47. info unicode-surrogate lodash.js:248:23

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

48. info unicode-surrogate lodash.js:248:31

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

49. info unicode-surrogate lodash.js:248:40

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

50. info unicode-surrogate lodash.js:248:48

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
          rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
          rsUpper = '[' + rsUpperRange + ']',
          rsZWJ = '\\u200d';

51. info critical → info by review dynamic-execution lodash.js:14992:16

    `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

          var result = attempt(function() {
            return Function(importsKeys, sourceURL + 'return ' + source)
              .apply(undefined, importsValues);
          });

    likely benign LLM, confidence 0.93 Lodash's _.template compiles a template string into a function via the Function constructor.

    Reasoning

    This is the standard lodash _.template implementation. It builds a function from the compiled template source and the import names, which is the documented purpose of the template feature. The flagged Function call is a normal, well-known library pattern. The snippet shows no encoding, no hidden payload, and no network or shell activity. The file name and content match the upstream library.

52. info critical → info by review dynamic-execution template.js:271:12

    `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

      var result = attempt(function() {
        return Function(importsKeys, sourceURL + 'return ' + source)
          .apply(undefined, importsValues);
      });

    likely benign LLM, confidence 0.93 Template compilation helper that builds a function from template source using the Function constructor.

    Reasoning

    The snippet is the same lodash template-compilation logic as the lodash.js finding: a Function constructor is given the template source and import names, then applied. This is an intended code-generation feature of template engines. Nothing in the snippet indicates obfuscation, a dropper, or malicious intent, and the code matches the upstream library.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/lodash/lodash lodash && cd lodash
git checkout 4f0b76e2eca13de1c1fe8b4305abc1f7d63f4b86
disclude scan --severity info --diff 0c9b60c1ae2656ef0d605e6726d72307eb5c31ff .