01 · Before and afterThe pattern
// before: store[url][profile] = token (url or profile may be "__proto__")
const raw = JSON.parse(text);
const store: Record<string, Record<string, string>> = Object.create(null);
for (const [url, profiles] of Object.entries(raw)) {
store[url] = Object.assign(Object.create(null), profiles);
}
// or simply: new Map<string, Map<string, string>>()02 · Run it on your appThe check
Does your CLI or service store anything in a plain object whose keys come from users, and have you tried the key __proto__?
If the honest answer is no or not sure, this is worth a look before it reaches production.