The vulnerability documentation explicitly identifies _recursiveMerge as the entry point. The GitHub commit diff shows the vulnerability was patched by adding key checks (proto, constructor, prototype) in this function. The Snyk PoC demonstrates prototype pollution occurs through recursiveMerge operations, which uses _recursiveMerge internally. The function's pre-patch behavior of recursively copying all properties without prototype chain validation matches CWE-915's pattern of improper dynamic object attribute modification.