Vulnerable lodash in dependency chain

aws-kcl@0.7.0 depends on machina@1.0.1 which depends on lodash@3.10.1

> Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
>
> The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.

https://www.npmjs.com/advisories/577

Start by tracing the dependency chain from aws-kcl@0.7.0 through machina@1.0.1 to lodash@3.10.1, then review advisory 577 and the affected lodash functions. Done means the dependency tree no longer resolves to a vulnerable lodash version and the package remains usable.

Written by the indexing model from the issue text.