Also, the fact that the library doesn't validate the type of the input data ({password: 1} when the password should be a string...).

This is just a cascading chain of failures.