In tangram NPM module, versions v0.1.0 through v0.21.1 are vulnerable to Prototype Pollution vulnerability since the function `mergeObjects()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or be able to manipulate the property which leads to Denial of Service or potentially Remote code execution.