fix: guard worker options from proto pollution

Author: AriPerkkio

src/index.ts

@@ -655,7 +655,14 @@ class ThreadPool {
     const filename = options.filename
       ? maybeFileURLToPath(options.filename)
       : null
-    this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }
+
+    this.options = Object.assign(
+      Object.create(null),
+      kDefaultOptions,
+      options,
+      { filename, maxQueue: 0 }
+    )
+
     // The >= and <= could be > and < but this way we get 100 % coverage 🙃
     if (
       options.maxThreads !== undefined &&

test/fixtures/fails-when-loaded.mjs

@@ -0,0 +1 @@
+throw new Error('Unexpectedly loaded fails-when-loaded.mjs!')

test/options.test.ts

@@ -1,3 +1,4 @@
+import { resolve } from 'node:path'
 import { expect, test, vi } from 'vitest'
 
 let Tinypool: typeof import('tinypool').default
@@ -47,6 +48,31 @@ test('fractional thread limits in the wrong order throw an error', async () => {
   }).toThrow()
 })
 
+test('ignores worker options from prototype', async () => {
+  {
+    const failsWhenLoaded = resolve(__dirname, 'fixtures/fails-when-loaded.mjs')
+
+    onTestFinished(() => {
+      // @ts-expect-error -- intentional
+      delete Object.prototype.execArgv
+      // @ts-expect-error -- intentional
+      delete Object.prototype.env
+    })
+
+    // @ts-expect-error -- intentional
+    Object.prototype.execArgv = ['--import', failsWhenLoaded]
+
+    // @ts-expect-error -- intentional
+    Object.prototype.env = { NODE_OPTIONS: `--import ${failsWhenLoaded}` }
+  }
+
+  const worker = new Tinypool({
+    filename: resolve(__dirname, 'fixtures/eval.js'),
+  })
+  const result = await worker.run('42')
+  expect(result).toBe(42)
+})
+
 vi.mock(import('node:os'), async (importOriginal) => {
   const original = await importOriginal()
   return {