bufio Prototype Pollution Vulnerability

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.
Vulnerability Details
Vulnerability Type
Prototype Pollution
Detailed Cause
bufio is a binary encoding/decoding library. Its write functions (such as writeBigU64) accept a destination object (dst) and perform direct dynamic property writes (dst[off++] = num).
If an attacker passes Object.prototype as the destination object, the library writes values directly onto the global prototype.
There is no check to prevent writing to built‑in prototypes, so this operation directly pollutes Object.prototype and affects all objects created afterward.
Vulnerable Code Location
package/package/lib/encoding.js:647 (DYNAMIC_PROP_WRITE sink)
Proof of Concept (POC)
```javascript
const lib = require('bufio');
lib.encoding.writeBigU64(Object.prototype, BigInt(1), 0);

// Verify pollution
console.log({}.polluted); // true
```

Start at package/package/lib/encoding.js:647 and trace writeBigU64 and the other write functions that accept a destination object. Reproduce the Object.prototype proof of concept from the issue, then verify that built-in prototypes are not modified while normal destinations still work.

Written by the indexing model from the issue text.