Object.prototype polluted by __proto__

prototype-pollution-1.ts

// you can play with the following code snippet in browser console.

let person = {name: 'John Doe'}
console.log(person.name)
// John Doe

person.__proto__.toString = () => {alert('evil')}
console.log(person.name)
// an alert box with "evil" pops up

let person2 = {}
console.log(person2)
// {}
// an alert box with "evil" pops up

// if you stay in the browser, 
// clicking any place in the page, you will see a new alert box pop up...