Companies Using Lodash

I read Lodash detections the way a sales team should, asking what a hit says about the company behind the domain. As of our October 2026 crawl, TechnologyChecker.io finds Lodash on 2,835,192 domains, and 1,749,736 of them match a company record, a 61.71% match rate. The short version: a Lodash hit rarely means a developer chose Lodash. Usually a website builder did.

What the signal catches, and what it misses

Our rule fires on _.differenceBy, a function only Lodash has, on a Lodash-specific template setting or on a script file named lodash, and it reads _.VERSION for the version. That version read turned out to create detections on its own, so pages whose _ is Underscore.js were landing in the Lodash count. We removed 1,298,905 such domains after none of the 54 we opened in a browser loaded Lodash, which took the raw 4,138,368 down to 2,835,192 together with 11,958 for-sale and gambling pages. The rule misses in the other direction as well: Lodash compiled into an app bundle, with no global, is invisible to it (our post on technology detection methods explains how signals like these are matched). The note at the end of this page has the full counts.

Most Lodash arrives with a website builder

The version string is a builder's fingerprint. In the 45 days to 12 October, 1,075,962 Wix sites reported 4.17.23 and 511,409 GoDaddy Website Builder sites reported 4.17.15. Duda accounted for 203,948 domains on 4.18, Shopify stores for 145,642 on 4.5.1, a build from February 2016, and Jimdo for 64,810 on Lodash 3.x. Together that is 2,001,771 of the 2,640,200 domains reporting a Lodash version (75.82%), each one a platform running its own signature version.

"Three in four Lodash detections tell you which platform built the site and nothing about the team that runs it. The version string is the part worth reading." - Mehmet Suleyman, CEO and Co-founder at TechnologyChecker.io

Sales Signal: Use Lodash as a platform proxy, not an engineering signal. Filter out Wix, GoDaddy Website Builder, Duda, Shopify and Jimdo first. What remains is the much smaller group that ships Lodash in its own code, and that is where developer-tool and security conversations make sense.

Growth trajectory

We publish one clean point, October 2026. Earlier monthly totals were counted before we removed the Underscore misreads, which make up 31.4% of today's raw count, so a chart would track our rule rather than Lodash. From here the cleaned count builds a series, and even then counts are not a like-for-like series over time: the set of domains we crawl turns over every month, with dead sites dropping out and newly found ones added, and our detection signals widen over time.

Our records show 476,191 domains dropping the Lodash signal on at least one hostname since we began tracking it on 16 March 2026. That figure is on the uncleaned basis, Underscore misreads included, so it is an upper bound and not a lifetime total; when I re-checked on 12 October, about 15% of the droppers (72,077 of 475,975) still carried the signal on another hostname.

Sales Signal: Size territories on the October count and don't trigger "just adopted Lodash" outreach from a first detection. A newly detected Lodash domain is most likely a new Wix or GoDaddy site.

The companies behind the domains

The matched base is small and young. 75.35% of companies with a size band have 1-10 employees, and 68.01% of those with a founding year date from 2010 or later. Construction (5%), Business Consulting (4.31%) and Retail (3.76%) lead an industry list whose top ten add up to only 30.22%. That is the customer profile of a consumer website builder.

The 10,347 companies above 1,000 employees behave differently. I opened all 50 detection URLs in our list on 12 October: 34 showed a Lodash global or file, and 29 of the 50 sit on a subdomain, such as community.ibm.com, rx.costco.com or privatebank.jpmorgan.com. Of the 32 that exposed a version through the global, 18 ran 4.18.1 and 12 ran 4.17.21. Lodash publishes no customer list, so none of this is vendor-confirmed.

Sales Signal: At an enterprise, go to the team that owns the detected surface. A support portal or customer-service site with its own Lodash build belongs to a product team, which is a better audience for dependency or front-end tooling than central IT.

Why this profile has no migration or competitor table

Utility libraries don't occupy an exclusive slot, so one doesn't replace another the way a CMS does. jQuery shows it: of the 2,514,651 domains we've seen running both, 2,148,185 still run both. Underscore.js, Lodash's ancestor, can't be compared fairly either, because our Underscore rule reads Lodash's _ and shows up on 98.6% of cleaned Lodash domains. The realistic alternatives are code changes invisible from outside: native JavaScript methods, or es-toolkit, which advertises a compatibility layer for replacing Lodash. A library usually leaves a site with a rebuild.

"Nobody migrates off Lodash in a way a crawler can see. Sites drop it when they're rebuilt, or when their builder updates its runtime." - Mehmet Suleyman, CEO and Co-founder at TechnologyChecker.io

Sales Signal: Skip "teams leaving Lodash" campaigns. If you sell a replacement library or a modernisation service, the version is the better trigger: a company serving 4.17.21 or older from its own code is running a Lodash release from February 2021 or earlier.

Reading the stack

React appears on 64.89% of Lodash domains and Bootstrap on 46.88%. Wix (40.62%) and GoDaddy Website Builder (19.77%) are behind much of that, together 60.39% of the base, and GoDaddy hosting covers 30.39%. Duda adds 7.9% and Jimdo 3.6%, while WordPress is down to 6.17% after the clean-up. Next.js shows up on just 1.84%, because modern React apps bundle Lodash without a global and barely register here.

Sales Signal: For web agencies, the Wix and GoDaddy overlap is the real list: small businesses on builder templates. For developer-tool vendors, filter to domains running Lodash with Next.js or Nuxt.js. That group is small, but it wrote its own front end.

Version hygiene is the useful angle

GitHub's advisory database lists two advisories, published on 1 April 2026, that cover every 4.x release up to 4.17.23 and are fixed in 4.18.0; older builds carry more. Only 15.06% of the 2,640,200 domains reporting a Lodash version run 4.18. Wix's 4.17.23 is one release behind, and GoDaddy Website Builder's 4.17.15 dates from July 2019. On a builder's front end the vulnerable functions rarely see user input, so this is a hygiene signal about the platform, not proof a site can be attacked. The OpenJS Foundation's January 2026 post describes the new security triage group and technical steering committee behind the recent releases.

Sales Signal: Security and dependency-scanning vendors should target companies that serve Lodash from their own code on 4.17.21 or older. 13 of the 32 checked companies in our list did on 12 October, and the version is visible to anyone who opens the page, which makes it a checkable opener.

How to use this list

Start from domains that report a Lodash version, drop the builder platforms, then filter to 51-1,000 employees, where companies are big enough to run their own front end. Read the detection URL last: a support or login subdomain usually means a product team's own app.

A workable opener: "Your [surface] serves Lodash [version], which GitHub's advisory database lists as affected by [advisory]. Here is how [product] keeps front-end dependencies current."

Build and export the filtered list from all 2,835,192 Lodash domains and 1,749,736 matched companies on TechnologyChecker.io.