The @perfood/couch-auth package version 0.21.2 and earlier stores session tokens and passwords in JavaScript objects without explicitly clearing them from memory. This behavior creates a risk that sensitive data could be extracted from memory using debugging tools or memory dump techniques, potentially enabling session hijacking.