Deep merge of untrusted JSON

This naive deep merge is used on a JSON request body. What does the last line print?

function merge(target, src) {
  for (const k in src) {
    if (typeof src[k] === 'object' && src[k] !== null) {
      target[k] = merge(target[k] || {}, src[k])
    } else target[k] = src[k]
  }
  return target
}

merge({}, JSON.parse('{"__proto__": {"isAdmin": true}}'))
console.log({}.isAdmin)