In general terms, the problem is that denormalizePrimaryKey writes to and deletes from a plain object (data) using computed property names (pk.name and spk.name). To prevent prototype pollution, we should ensure that these names are not dangerous special keys like "__proto__", "constructor", or "prototype" before using them as object keys. If they are dangerous, we should skip the denormalization logic for those keys.

The best minimally-invasive fix is to add a small internal guard function in EntityFactory that checks whether a property name is safe to use as an object key, and then use this check in denormalizePrimaryKey before accessing data[pk.name] and data[spk.name]. Specifically, in packages/core/src/entity/EntityFactory.ts:

1. Add a private helper method inside EntityFactory (near other private helpers like processDiscriminatorColumn and denormalizePrimaryKey):

private isSafePropertyKey(key: string | number | symbol): boolean {
  if (typeof key !== 'string') {
    return true;
  }
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}

2. Update denormalizePrimaryKey so that before reading or writing data[pk.name] or data[spk.name], it verifies that both pk.name and spk.name are safe via isSafePropertyKey. If either is unsafe, immediately return without modifying data. This prevents any direct or indirect library/user control from ever writing to those special properties on plain objects, while leaving all existing behavior unchanged for normal keys like "id".

No changes are required in Reference.ts beyond what is already present; Reference.unwrapReference only passes through data, and the hardened denormalizePrimaryKey will now safely handle any keys it encounters.

Implementation details:

• All edits occur in packages/core/src/entity/EntityFactory.ts, within the shown class.
• No existing imports or external dependencies need to change; we only add a new private method and adjust an if condition.
• The logic in denormalizePrimaryKey remains the same except for the added safety check; thus, existing functionality for legitimate entity definitions is preserved.