I found the prototype pollution in configya.js,the function deepMerge() in configya/src/configya.js in configya2.0.3.
The function deepMerge() lead to Prototype pollution in line10. Hopefully, you can modify your code to avoid the risk of this vulnerability
https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html