prototype pollution

[ameinhardt]

Is this library intended for usage with user input (i.e. as PATCH in http server)?
In that case, maybe it would be good to point out (or fix) the possibility of prototype pollution, e.g.

apply(a, JSON.parse('{ "__proto__": { "abc": 42 }}'))