npm ranks “most depended-upon packages” by direct dependencies. So for Lodash that is pubic & private packages that have Lodash listed in their package.json dependencies field.

The difference between GitHub and npm rankings could be attributed to counting repo forks and/or the fact that just because a project has a package.json does not mean it’s published to the npm registry.

Links:
* npm dependency count offset (offset includes private pkgs)
* daily updated rank of pkgs directly depending on Lodash (public pkgs)