It's an unfortunate accident but I'll write down why I think it's good. > having countless hours of work be obliterated by an automated system without manual r

It's an unfortunate accident but I'll write down why I think it's good. > having countless hours of work be obliterated by an automated system without manual review (presumably) is terrifying The code in question was "obfuscated" to an automated system, yeah they're unicode escape string for a utility library but a lot of usages of binary/unicode escape strings in code is considered to be some malicious obfuscation. What they did is smart. They have their analyzer set to fire on obfusacted code. They direct it to you. If you're a perpetrautor you'll say oh noes they got me, if you're innocent - you'll request manual review, contact support or escalate in some other way and they get their manual review from you actually. I would guess that their false-positive rate for this static analysis has to be low. There aren't many legitamate usecases for these escape strings. The solution they could consider is to after this alert is fired to check whether the file in question matches a checksum of some recent lodash releases but in the end "using lodash" is not an excuse, as a developer you're also responsible for the dependencies you bundle with your extension so you should be mindful of what code malicious or not is in there.