Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT

lodash-merge-deep

First seen: Sep 12, 2024 0 viewsMimics: lodash.merge
Share threatHN
Threat Description

Hallucinated deep-merge helper for lodash. The package monkeypatches Object.prototype during install, polluting prototypes across the host application and enabling remote code execution via crafted JSON payloads.

AI Hallucination Analysis
Very Likely AI Hallucination85%
Known to be hallucinated by: Copilot, Cursor
Remediation Guide
  1. Remove 'lodash-merge-deep' from your dependencies immediately.
  2. Replace with the legitimate package 'lodash.merge'.
  3. Audit your codebase for prototype pollution vulnerabilities.
  4. Rotate any exposed secrets.
Quick Facts
Ecosystem
npm
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
lodash.merge
Hallucination Confidence
85%
Check My Project
Scan for this package