object.assign

The field in currently uses an unauthenticated or SSH git URL. This requires package consumers and registry tools to have authenticated SSH GitHub access or unblocked git protocols to resolve the repository metadata. This PR updates it to an HTTPS URL () which is publicly accessible and standard for npm packages.

Hi, we are a security team. We found a prototype pollution vulnerability in your project. The issue affects . The vulnerable behavior happens when properties from a user-controlled source object are copied into a target object through dynamic property assignment. Prototype pollution may occur either when an enumerable property is copied into a target object, or when is used as the assignment target. Impact An attacker may be able to modify a target object's prototype or directly pollute the global prototype in the affected runtime. Proof of concept Case 1: enumerable on source object Case 2: as target Details We confirmed the following cases: sink: sink: The root cause is that untrusted key material can flow into dynamic property writes without blocking special prototype-related writes.

Hi @ljharb , I encountered a malware warning today when using version 4.1.7. !image command is failing. !image Could you please investigate version 4.1.7 for potential malware