CVE-2024-38988: @alizeait/unflatto Prototype Pollution

The core vulnerability existed in the unflatto function's property assignment logic, which previously didn't validate keys for prototype pollution vectors. The security patch adds explicit checks for 'prototype', 'proto', and 'constructor' keys during the unflattening process. This function is directly referenced in all vulnerability reports and the CVE description as the entry point for prototype pollution. The commit diff shows critical security controls were added to this specific function, confirming it was the vulnerable component.