lodash 4.18.1

Source: https://github.com/lodash/lodash
Artifact scanned: lodash-4.18.1.tgz (npm tarball · 308.2 KB · SHA-256 696942c2a488…)
Compared with: lodash-4.18.0.tgz (0 signals introduced since)
Files: 1048 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 52 info
Scan time: 3.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 21:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-surrogate _hasUnicode.js:2:23

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _hasUnicode.js:2:31

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeSize.js:2:23

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeSize.js:2:31

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeSize.js:12:16

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeSize.js:12:24

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeSize.js:12:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeSize.js:15:23

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:15:31

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:15:39

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:16:21

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:16:29

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:16:38

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeSize.js:16:46

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:2:23

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeToArray.js:2:31

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeToArray.js:12:16

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeToArray.js:12:24

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeToArray.js:12:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsCombo = '[' + rsComboRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeToArray.js:15:23

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:15:31

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:15:39

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:16:21

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:16:29

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:16:38

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeToArray.js:16:46

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeWords.js:2:23

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeWords.js:2:31

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

/** Used to compose unicode character classes. */
var rsAstralRange = '\\ud800-\\udfff',
    rsComboMarksRange = '\\u0300-\\u036f',
    reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate _unicodeWords.js:25:16

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeWords.js:25:24

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

    rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeWords.js:25:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
    rsFitz = '\\ud83c[\\udffb-\\udfff]',
    rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
    rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate _unicodeWords.js:28:23

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate _unicodeWords.js:28:31

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate _unicodeWords.js:28:39

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsNonAstral = '[^' + rsAstralRange + ']',
    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate _unicodeWords.js:29:21

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeWords.js:29:29

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeWords.js:29:38

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',
    rsZWJ = '\\u200d';

info unicode-surrogate _unicodeWords.js:29:46

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
    rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
    rsUpper = '[' + rsUpperRange + ']',
    rsZWJ = '\\u200d';

info unicode-surrogate lodash.js:220:25

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  /** Used to compose unicode character classes. */
  var rsAstralRange = '\\ud800-\\udfff',
      rsComboMarksRange = '\\u0300-\\u036f',
      reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate lodash.js:220:33

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

  /** Used to compose unicode character classes. */
  var rsAstralRange = '\\ud800-\\udfff',
      rsComboMarksRange = '\\u0300-\\u036f',
      reComboHalfMarksRange = '\\ufe20-\\ufe2f',

info unicode-surrogate lodash.js:244:18

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
      rsFitz = '\\ud83c[\\udffb-\\udfff]',
      rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
      rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate lodash.js:244:26

orphaned low surrogate \uDFFB (no preceding high surrogate) (token pass, confidence 0.65)

      rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
      rsFitz = '\\ud83c[\\udffb-\\udfff]',
      rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
      rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate lodash.js:244:34

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      rsMisc = '[^' + rsAstralRange + rsBreakRange + rsDigits + rsDingbatRange + rsLowerRange + rsUpperRange + ']',
      rsFitz = '\\ud83c[\\udffb-\\udfff]',
      rsModifier = '(?:' + rsCombo + '|' + rsFitz + ')',
      rsNonAstral = '[^' + rsAstralRange + ']',

info unicode-surrogate lodash.js:247:25

orphaned high surrogate \uD83C (no matching low surrogate) (token pass, confidence 0.65)

      rsNonAstral = '[^' + rsAstralRange + ']',
      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate lodash.js:247:33

orphaned low surrogate \uDDE6 (no preceding high surrogate) (token pass, confidence 0.65)

      rsNonAstral = '[^' + rsAstralRange + ']',
      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate lodash.js:247:41

orphaned low surrogate \uDDFF (no preceding high surrogate) (token pass, confidence 0.65)

      rsNonAstral = '[^' + rsAstralRange + ']',
      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',

info unicode-surrogate lodash.js:248:23

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',
      rsZWJ = '\\u200d';

info unicode-surrogate lodash.js:248:31

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',
      rsZWJ = '\\u200d';

info unicode-surrogate lodash.js:248:40

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',
      rsZWJ = '\\u200d';

info unicode-surrogate lodash.js:248:48

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      rsRegional = '(?:\\ud83c[\\udde6-\\uddff]){2}',
      rsSurrPair = '[\\ud800-\\udbff][\\udc00-\\udfff]',
      rsUpper = '[' + rsUpperRange + ']',
      rsZWJ = '\\u200d';

info ~~critical~~ → info by review dynamic-execution lodash.js:14992:16

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
      var result = attempt(function() {
        return Function(importsKeys, sourceURL + 'return ' + source)
          .apply(undefined, importsValues);
      });
```
likely benign LLM, confidence 0.93 Lodash's _.template builds a function from compiled template source via the Function constructor and applies it.
Reasoning
This is the body of lodash's _.template implementation. It builds a function from the compiled template source and then applies it with the imports. Lodash documents this behaviour, and the source is the output of lodash's own template compiler. The flagged pattern is the documented mechanism of a template engine, not a hidden payload, and nothing in the snippet reaches the network or spawns processes. The finding is the expected AST match on Function() with a non-literal body, so it is a false positive for a legitimate library.
info ~~critical~~ → info by review dynamic-execution template.js:271:12

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
  var result = attempt(function() {
    return Function(importsKeys, sourceURL + 'return ' + source)
      .apply(undefined, importsValues);
  });
```
likely benign LLM, confidence 0.93 A copy of lodash's _.template compiler that constructs a function from template source using the Function constructor.
Reasoning
This is the same lodash _.template construction code, shown again in a separate template.js file. Function(importsKeys, sourceURL + 'return ' + source) is the standard way the template engine turns compiled source into a callable. The snippet has no obfuscation, encoded input, or network or process activity, so it reads as a legitimate template engine rather than malicious dynamic execution.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o lodash-4.18.1.tgz https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz
printf '%s  %s\n' 696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16 lodash-4.18.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf lodash-4.18.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg