prototype-pollution

From README

Prototype Pollution Security Check (CWE-1321) What this checks Protects against prototype pollution in JavaScript/TypeScript where an attacker injects properties like proto or constructor.prototype through user input, modifying the prototype chain of all objects. Exploitation leads to property injection, auth bypass, and remote code execution in some frameworks. Vulnerable patterns Deep merge of user input into a config or options object using a library helper that recurses through proto. Object.assign or spread of a parsed JSON body into a target object — the proto key is copied as a regular property and walked by the engine. Custom recursive merge that iterates source keys with no filter — proto and constructor.prototype are merged in alongside everything else. Dynamic property assignment where both the key and the value come from user input, with no key validation. Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties.