It's ten times better than entering your credentials on another website, but the code could still do some fun stuff with it. I kinda doubt it, but just saying.
The code is there for you to see, what harm can it possibly do? If you're cautious of this, you should be cautious about entering your username/password into web browsers to sign into websites I think...
The codebase can easily get big enough to miss it transmitting your credentials if you don't spend hours looking at it. Even in a 100 line script you can overlook a well hidden request, especially if it's extra data included in an existing request.