Address Prototype Pollution vulnerability

[omrilotan]

TL;DR

This vulnerability exposes language construct prototypes to unwanted modifications

defaultsDeep(
  {},
  { constructor: { prototype: { isAdmin: true } } }
);

console.log({}.isAdmin); // true for all objects now

Further reading:

• Prototype Pollution attack

Open reports:

• NPM advisory
• Snyk CVE
• Hackerone report

[omrilotan]

@jonschlinkert It there any hope to release this security patch?