Prototype Pollution

steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the module.exports function of babel.js and modify attributes such as __proto__, constructor, and prototype.