Threats affecting pkg:npm/immutable-js

Immutable.js versions prior to 3.8.3, 4.3.7, and 5.1.5 contain a Prototype Pollution vulnerability. This flaw affects several APIs including mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), allowing attackers with some level of privilege to inject properties into JavaScript object prototypes. The vulnerability has been patched in the specified fixed versions.