Summary by cubic

Adds an end-to-end test to ensure a prototype-polluted Object.prototype.parseReviver cannot tamper with JSON responses in axios.get. Strengthens coverage for AXI-210 (invisible JSON response tampering via prototype pollution).

Description

• Adds an E2E test in tests/unit/prototypePollution.test.js that:
  • Pollutes Object.prototype.parseReviver
  • Serves a JSON payload over a local HTTP server
  • Asserts the reviver is never called, the response equals the original payload, and no keys are exfiltrated
• Validates the fix path for GHSA-3w6x-2g7m-8v23 through the full axios.get pipeline

Docs

• Suggest adding a short security note in /docs/ (e.g., security.md) describing that response parsing is hardened against prototype-polluted revivers, referencing AXI-210 and GHSA-3w6x-2g7m-8v23

Testing

• Added: one E2E unit test under tests/unit/prototypePollution.test.js
• No other tests changed

Semantic version impact

• None (tests-only change; no API or behavior changes)

^{Written for commit 3a57ac0. Summary will update on new commits.}