Object prototype modification via unfiltered configuration merge

Prototype pollution in Jarrad Seers config-handler through 2.0.3 allows attackers to alter inherited object properties via configuration files. The ConfigHandler constructor loads package.json and environment configuration modules, then passes their exported objects to object-merger without filtering constructor.prototype keys. Exploitation requires influence over a loaded file; the demonstrated result adds an attacker-chosen property to Object.prototype, while downstream impact depends on inherited-property use in the consuming Node.js application.