toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...