Application denial of service via prototype pollution

Prototype pollution in the set and config functions of spmrc 1.2.0 and earlier allows remote attackers to interrupt applications. The set function splits an attacker-controlled dotted key and writes its segments through a plain object, so a first segment of proto resolves Object.prototype and the second segment becomes a global inherited property; config delegates two-argument calls to set. Exploitation requires a consuming Node.js application to pass attacker-controlled keys and truthy values to these APIs, and the bounded consequence is application instability or denial of service.