Prototype pollution via unsafe recursive merge

Prototype pollution in all lutils versions allows attackers to modify Object.prototype properties through crafted merge inputs. The main merge function recursively copies attacker-controlled proto keys into a destination object without filtering prototype-mutating properties. A consuming application must pass attacker-controlled objects to merge; the resulting inherited properties can alter application behavior, while downstream impact depends on available code paths.