Prototype pollution via array-wrapped __proto__ path

Prototype pollution in bmoor before 0.10.1 allows remote attackers to modify object prototypes through crafted property paths. The set function compares path elements against blocked property names without first coercing array-wrapped elements to strings, so an array containing proto bypasses the denylist and writes to Object.prototype. Exploitation requires a consuming application to pass an attacker-controlled path to set; polluted inherited properties can alter application data or behavior, and the exact consequence depends on how the application uses them.