Exposure of Sensitive Information to an Unauthorized Actor in parse-url

First Assume this example

parseUrl("http://[email protected]:[email protected]/path/name?foo=bar&bar=42#some-hash")

That returns:

protocol: "http"
port: null
resource: "[email protected]"
user: ""
pathname: "/[email protected]/path/name"
hash: "some-hash"
search: "foo=bar&bar=42"
href: "http://[email protected]:[email protected]/path/name?foo=bar&bar=42#some-has"

Expected result:

With the same URL in the URL interface of nodejs we have following result:

host: "google.com"
hostname: "google.com"
href: "http://firstdomain.com%40jflsdk.com:[email protected]/path/name?foo=bar&bar=42#some-hash"
origin: "http://google.com"
password: "20200"
pathname: "/path/name"
port: ""
protocol: "http:"
search: "?foo=bar&bar=42"
searchParams: URLSearchParams {}
username: "firstdomain.com%40jflsdk.com"

In parse-url, You can see that the resource and href have different origins but they have the same origin in the URL interface of nodejs/browser.