//nefariousplan

Object Literal As Map

JavaScript code uses a plain object literal `{}` as a string-keyed dictionary against attacker-controlled keys. Plain objects inherit twelve keys from `Object.prototype`; every one of them resolves to a non-undefined inherited value through bracket lookup. Names like `__proto__`, `hasOwnProperty`, and `toString` reach those values without writing anything to the prototype. The default container leaks the prototype chain. `Object.create(null)` and `Map` do not.