JSON5 makers apparently didn’t even know about prototype pollution until this week.