Prototype Pollution Detection

When to Use

Audit merge/clone/deep-assign utilities, query string parsers, JSON parsers, config mergers, and any package that recursively sets object properties from untrusted input.

Key insight: Only ~50% acceptance rate. Must demonstrate REAL impact beyond just polluting prototype.

Process

Step 1: Find Object Manipulation Sinks

grep -rn "Object\.assign\|Object\.defineProperty\|Object\.create" .
grep -rn "merge\|extend\|deepMerge\|deepExtend\|deepAssign\|mixin" .
grep -rn "clone\|deepClone\|cloneDeep\|deepCopy" .
grep -rn "set\|setPath\|setValue\|lodash\.set\|_.set" .
grep -rn "\[.*\]\s*=" . --include="*.js"  # Bracket notation assignment