[awais-ur-rehman]

Summary

When Buffer is unavailable, malformed base64 credentials such as Basic Y or Basic . make the native Uint8Array.fromBase64 decoder throw instead of returning the documented undefined result. Catch decode failures in parse(), with regression tests covering invalid characters, incomplete base64, and valid credentials through the browser decoder.

Breaking Changes

None.

Testing

• npm exec --yes --package=node@latest -- npm test on Node 26.12.1 — 35 tests passed, none skipped, with native Uint8Array.fromBase64; 100% statement, branch, function, and line coverage.
• npm test on Node 24.13.0 — 30 passed; five browser-decoder tests skipped because this runtime does not expose the Uint8Array base64 APIs.
• The complete test command includes build, formatting, type checking, and bundle-size checks (530 B against a 1 kB limit).
• git diff --check
• To reproduce manually in a runtime with Uint8Array.fromBase64, set globalThis.Buffer = undefined before importing basic-auth, then call parse('Basic Y'); it now returns undefined.

[blakeembrey]

This is a great fix, but the approach isn't what I'd recommend. Can you instead align the implementation within base64.ts? It should return an empty string to align with node behavior, and keep the catch out of the main code path for node.

There's also already a test file you can update to cover both cases.