Download websites that use Underscore.js

About Underscore.js

There is a category of software that nobody installs any more and that keeps turning up anyway. Underscore.js is a clean example of it. Released in 2009, the library supplied the array, object and function helpers that the language itself did not have, and for years few serious codebases went without one of them. JavaScript then absorbed most of the ideas into the standard. A developer starting a project today has no reason to add it, and we keep finding it regardless.

The explanation is that it usually arrives as luggage. A charting widget, an old admin theme, a marketing tag or a bundled plugin brings the library along, and the site owner never chose it and does not know it is present. As of September 2026 we detect it on 2,059,320 sites, and the figure should be read as a measure of what the web has accumulated rather than of what anyone is currently adopting.

Understood that way, presence becomes a dating tool. A domain serving this library is likely to be serving other code from the same period, because bundles rarely age alone. The library is small, MIT licensed and harmless in itself, so a finding is not a vulnerability report and we will not dress it up as one. A finding is an indication that a page's JavaScript has layers, that some of those layers are old, and that nobody has audited the bottom of the stack in a long time.

The version picture is unusually wide for a library this stable. We record 1,123 distinct version strings, and the release we see most often is 1.13.8. The spread comes from the delivery model rather than from churn. Copies sit inside other people's bundles, pinned to whatever was current when that bundle was built, and they move only when the parent product moves. Version detection is also partial, because a minified copy concatenated into a larger file often carries no readable marker, which means a share of installs appear in the count with no release attached.

United States accounts for 722,381 of the sites where we find it, and .com carries the bulk of the domain mix. The audience for a list like this is not developers shopping for a utility library. Supply chain and application security teams want to know where old client-side code physically sits across a portfolio. Performance vendors want sites still shipping helper code that duplicates the language. Agencies and platform migrators want evidence, in a form a client will accept, that a site rests on foundations laid a long time ago. Researchers studying how dependencies decay want the population itself and its movement between snapshots.

One domain can be checked by hand in a browser console, and for one domain that is the right tool. The value of the download is in the shape of the population instead. Which hosts, which countries, which co-occurring platforms, which sites carry the library together with an equally old jQuery, and how many of them fall out of the list from one snapshot to the next. Answering any of that from lookups would mean guessing the domain list first, and guessing the domain list is exactly the work the dataset exists to remove.