Circumvent this credentials validator
username = 'toString', password = {}.toString

Try it online!
Note: Due to a certain username pointed out by Wezl in the comments, this answer is not valid for the current challenge.
Why this works:

 Among other properties, Object.prototype.toString is inherited from Object.prototype, even if it wasn't a part of the object literal given to the validator. Since any object inherits the same function {}.toString is the same as the toString of the credentials object.