{"package":"lodash","installedVersion":"4.17.20","latestVersion":"4.18.1","releaseEvidence":{"installed":{"version":"4.17.20","publishedAt":"2020-08-13T16:53:54.152Z","integrity":"sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==","shasum":"b44a9b6297bcb698f1c51a3545a2b3b368d59c52","tarball":"https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz","unpackedSize":1406354,"fileCount":1049},"latest":{"version":"4.18.1","publishedAt":"2026-04-01T21:01:20.458Z","integrity":"sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==","shasum":"ff2b66c1f6326d59513de2407bf881439812771c","tarball":"https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz","unpackedSize":1413741,"fileCount":1051},"basis":"Publisher/registry release metadata from the npm registry. integrity is npm dist.integrity when present; shasum is npm dist.shasum. These fields support reproducible package-release verification but do not independently prove publisher identity."},"minimumSafeVersion":"4.18.0","minimumSafeVersionBasis":"Lowest published stable npm version at or above installedVersion with zero OSV matches at checkedAt; not a security guarantee.","remediationPriority":"elevated","recommendedAction":"Upgrade to minimumSafeVersion or a later compatible release after normal compatibility testing.","weeklyDownloads":163294778,"weeklyDownloadsPeriod":{"start":"2026-10-04","end":"2026-10-10"},"maintainers":1,"deprecated":false,"deprecationMessage":null,"vulnerabilityCount":5,"knownExploitedCount":0,"maxEpssScore":0.21333,"vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"fixedVersion":"4.17.21","fixedVersions":["4.17.21"],"cveAliases":["CVE-2020-28500"],"epss":[{"cve":"CVE-2020-28500","score":0.07336,"percentile":0.9426,"date":"2026-10-11"}],"cisaKev":null,"knownExploited":false},{"id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-r5fr-rjxr-66jc"],"fixedVersion":"4.17.21","fixedVersions":["4.17.21"],"cveAliases":["CVE-2021-23337","CVE-2026-4800"],"epss":[{"cve":"CVE-2021-23337","score":0.21333,"percentile":0.97554,"date":"2026-10-11"},{"cve":"CVE-2026-4800","score":0.02618,"percentile":0.85037,"date":"2026-10-11"}],"cisaKev":null,"knownExploited":false},{"id":"GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"fixedVersion":"4.18.0","fixedVersions":["4.18.0"],"cveAliases":["CVE-2025-13465","CVE-2026-2950"],"epss":[{"cve":"CVE-2025-13465","score":0.0185,"percentile":0.78517,"date":"2026-10-11"},{"cve":"CVE-2026-2950","score":0.00377,"percentile":0.2971,"date":"2026-10-11"}],"cisaKev":null,"knownExploited":false},{"id":"GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-35jh-r3h4-6jhm"],"fixedVersion":"4.18.0","fixedVersions":["4.18.0"],"cveAliases":["CVE-2021-23337","CVE-2026-4800"],"epss":[{"cve":"CVE-2021-23337","score":0.21333,"percentile":0.97554,"date":"2026-10-11"},{"cve":"CVE-2026-4800","score":0.02618,"percentile":0.85037,"date":"2026-10-11"}],"cisaKev":null,"knownExploited":false},{"id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-f23m-r3pf-42rh"],"fixedVersion":"4.17.23","fixedVersions":["4.17.23"],"cveAliases":["CVE-2025-13465","CVE-2026-2950"],"epss":[{"cve":"CVE-2025-13465","score":0.0185,"percentile":0.78517,"date":"2026-10-11"},{"cve":"CVE-2026-2950","score":0.00377,"percentile":0.2971,"date":"2026-10-11"}],"cisaKev":null,"knownExploited":false}],"signals":["known_vulnerabilities","epss_score_at_or_above_0_1","newer_version_available","safe_upgrade_available"],"source":["npm registry (including dist.integrity/dist.shasum release metadata)","npm downloads API","OSV.dev","FIRST EPSS API (best effort)","CISA Known Exploited Vulnerabilities catalog (best effort)"],"methodology":"Combines current npm metadata and release integrity fields with exact-version OSV vulnerability lookup. Fixed versions are copied from OSV fixed events for the queried npm package. CVE aliases are best-effort enriched with current FIRST EPSS probability/percentile and CISA KEV known-exploitation evidence. remediationPriority and recommendedAction are deterministic rules over those observable signals; they are prioritization aids, not a security guarantee. minimumSafeVersion is independently checked against published npm versions and exact-version OSV results. Enrichment failure does not fail the core result.","relatedServices":{"packageHealth":"https://tkoqkknsezxavtxfywkm.supabase.co/functions/v1/npm-health-x402-v2?package=lodash","batchMultiEcosystemVulnerabilityIntel":"https://tkoqkknsezxavtxfywkm.supabase.co/functions/v1/base-vuln-intel/v1/vulnerability-intel"},"checkedAt":"2026-10-12T04:16:26.891Z"}