Object prototype modification via unsafe deep merge

Prototype pollution in Stampit supermixer before 1.0.5 allows attackers to alter base-object prototypes through crafted merge input. The merge iteratee copies an untrusted proto key, and constructor functions, into the target instead of rejecting prototype-sensitive keys. Any consuming application that passes attacker-controlled objects to merge is exposed; consequences depend on reachable prototype gadgets and include unauthorized property changes.