Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')