prototype-pollution

This code is an exploit-focused prototype pollution PoC skeleton. If the referenced merge/deep-merge utility fails to defend against __proto__/constructor.prototype, it can pollute Object.prototype, enabling global property injection (e.g., isAdmin), runtime crashes via clobbered toString, and potential downstream security impacts in other application code that consumes polluted objects. No direct malware behaviors (exfiltration/persistence) are implemented here, but the demonstrated vulnerability class is high-impact if present in real dependencies.