Affected: npm: axios

## Summary

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.

The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.

## Impact

This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.

Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.

The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.

This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.

## Affected Functionality

Affected runtime functionality:

- Node HTTP adapter Basic auth handling in `lib/adap…