All findings are false positives. The flagged files are standard Lodash 4.18.1 source implementing Unicode normalization (deburr), word splitting, and template compilation. Unicode escapes and regex ranges are legitimate data for Latin character handling; Function() usage in template.js is the documented, intentional compilation mechanism. No credential theft, exfiltration, remote execution, or other malicious behavior exists in the source.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Lodash is a modular utility library for JavaScript, with main entry at lodash.js and numerous internal helper modules for arrays, objects, and strings.
Capabilities
- Provides modular JavaScript utility functions
- Contains obfuscated source files
- Includes hardcoded public IP in network code
Data access
- None observed
Network
- Contains hardcoded public IP in network code
Static analysis flags multiple obfuscated files and hardcoded IPs, which may require review despite the package's stated purpose as a utility library.
Security findings (12)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in _deburrLetter.js
Multiple obfuscation patterns in package/_deburrLetter.js
Multiple obfuscation patterns in _unicodeWords.js
Multiple obfuscation patterns in package/_unicodeWords.js
Multiple obfuscation patterns in deburr.js
Multiple obfuscation patterns in package/deburr.js
Multiple obfuscation patterns in lodash.min.js
Multiple obfuscation patterns in package/lodash.min.js
Multiple obfuscation patterns in template.js
Multiple obfuscation patterns in package/template.js
File now.js contains a hardcoded public IP (00:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
File package/now.js contains a hardcoded public IP (00:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/lodash