The code is there for you to see, what harm can it possibly do? If you're cautious of this, you should be cautious about entering your username/password into web browsers to sign into websites I think...
The codebase can easily get big enough to miss it transmitting your credentials if you don't spend hours looking at it. Even in a 100 line script you can overlook a well hidden request, especially if it's extra data included in an existing request.