basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information
this issue has been fixed in basic-auth-connect 1.1.0