The npm package lodash itself is not an ECMAScript module and therefore produces the warning. There are multiple ways to fix this:

Replace with ES modulized library (recommended)

Some libraries offer ES modulized builds. In case of lodash, you can replace it with lodash-es.

Run npm install --save lodash-es.

Now replace all imports from lodash with lodash-es.

Also make sure to import the library with ES import statements:

import { keys } from 'lodash-es';

Whitelist CommonJS dependency

If there is no ES modulized build available for your library, or if you for some reason don't care, you can allow specific CommonJS dependencies in the angular.json file:

"architect": {
  "build": {
    "builder": "@angular-devkit/build-angular:browser",
    "options": {
      "allowedCommonJsDependencies": ["lodash"]
    }
  }
}

Since Angular CLI Version 10.0.1 you can use globs in allowedCommonJsDependencies. This means that if you pass lodash, the sub-paths (e.g. lodash/keys) will also be allowed.

Docs reference: https://angular.io/guide/build#configuring-commonjs-dependencies