Dev Package

{
  "asOf": "2026-10-08T16:18:31.547Z",
  "daysSinceLatestRelease": 189,
  "dependencyCount": 0,
  "deprecated": null,
  "description": "Lodash modular utilities.",
  "downloadsLastWeek": 203122461,
  "ecosystem": "npm",
  "homepage": "https://lodash.com/",
  "isLatest": false,
  "latestPublishedAt": "2026-04-01T21:01:20.458Z",
  "latestVersion": "4.18.1",
  "license": "MIT",
  "maintainersCount": 1,
  "name": "lodash",
  "note": "Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).",
  "osvRecords": 5,
  "publishedAt": "2020-08-13T16:53:54.152Z",
  "repository": "https://github.com/lodash/lodash",
  "riskFlags": [
    "known_vulnerabilities",
    "high_or_critical_vulnerability",
    "newer_version_available"
  ],
  "source": "npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev",
  "version": "4.17.20",
  "vulnerabilities": [
    {
      "aliases": [
        "CVE-2021-23337",
        "CVE-2026-4800",
        "GHSA-r5fr-rjxr-66jc"
      ],
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "fixedIn": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "published": "2021-05-06T16:05:51.000Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
    },
    {
      "aliases": [
        "CVE-2021-23337",
        "CVE-2026-4800",
        "GHSA-35jh-r3h4-6jhm"
      ],
      "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "fixedIn": [
        "4.18.0"
      ],
      "id": "GHSA-r5fr-rjxr-66jc",
      "published": "2026-04-01T23:51:12.000Z",
      "severity": "HIGH",
      "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
      "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
    },
    {
      "aliases": [
        "CVE-2020-28500"
      ],
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "fixedIn": [
        "4.17.21"
      ],
      "id": "GHSA-29mw-wpgm-hmr9",
      "published": "2022-01-06T20:30:46.000Z",
      "severity": "MODERATE",
      "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
    },
    {
      "aliases": [
        "CVE-2025-13465",
        "CVE-2026-2950",
        "GHSA-xxjr-mmjv-4gpg"
      ],
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "fixedIn": [
        "4.18.0"
      ],
      "id": "GHSA-f23m-r3pf-42rh",
      "published": "2026-04-01T23:50:27.000Z",
      "severity": "MODERATE",
      "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
      "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh"
    },
    {
      "aliases": [
        "CVE-2025-13465",
        "CVE-2026-2950",
        "GHSA-f23m-r3pf-42rh"
      ],
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "fixedIn": [
        "4.17.23"
      ],
      "id": "GHSA-xxjr-mmjv-4gpg",
      "published": "2026-01-21T23:01:22.000Z",
      "severity": "MODERATE",
      "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "url": "https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg"
    }
  ],
  "vulnerabilityCount": 5
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://fiatdock.com/v1/dev/package' \
  -H 'content-type: application/json' \
  --data-raw '{"ecosystem":"npm","name":"lodash","version":"4.17.20"}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://fiatdock.com/v1/dev/package' \
  -H 'content-type: application/json' \
  --data-raw '{"ecosystem":"npm","name":"lodash","version":"4.17.20"}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.0027 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.0027" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.0027 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ffiatdock.com%2Fv1%2Fdev%2Fpackage&method=POST
const res = await pay("https://fiatdock.com/v1/dev/package", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "ecosystem": "npm",
    "name": "lodash",
    "version": "4.17.20"
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.0027 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.0027"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://fiatdock.com/v1/dev/package",
        json={
            "ecosystem": "npm",
            "name": "lodash",
            "version": "4.17.20",
        },
    )
    print(res.status_code, res.text)