fix: avoids prototype pollution

Author: kricsleo

src/defu.ts

@@ -12,7 +12,7 @@ function _defu<T>(
     return _defu(baseObject, {}, namespace, merger);
   }
 
-  const object = Object.assign({}, defaults);
+  const object = { ...defaults };
 
   for (const key in baseObject) {
     if (key === "__proto__" || key === "constructor") {

test/defu.test.ts

@@ -110,6 +110,12 @@ describe("defu", () => {
     defu({}, payload);
     defu(payload, {});
     defu(payload, payload);
+
+    const malicious = JSON.parse('{"__proto__":{"isAdmin":true}}');
+    const result = defu(malicious, { isAdmin: false });
+
+    expect(result.isAdmin).toBe(false);
+
     // @ts-ignore
     expect({}.isAdmin).toBe(undefined);
   });