Advisories for Npm/Gettext-Converter package

js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object. A key whose segment is proto (e.g. proto##gcPolluted) causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime. Any application that converts translation …