I reproduced credential stuffing exactly,
and I'm publishing the code that stops it

// Vulnerable login API — a matching password is the whole check.
// A leaked-password list from another breach, tried here as-is,
// gets through (verified directly with hydra).
class PasswordOnlyLogin {
  constructor(userDb) {
    this.db = userDb; // { username: password }
  }

  login(username, password) {
    if (this.db[username] === password) {
      return { status: 'ok' };
    }
    return { status: 'invalid_credentials' };
  }
}

module.exports = { PasswordOnlyLogin };

// The fix: BOTH the password AND a second factor (TOTP-style) are
// required. Even a 100% correct leaked password is useless to an
// attacker who doesn't have the code that changes in real time.
class MfaGuardedLogin {
  constructor(userDb, totpProvider) {
    this.db = userDb;
    this.totp = totpProvider; // .currentCode(username)
  }

  login(username, password, totpCode) {
    if (this.db[username] !== password) {
      return { status: 'invalid_credentials' };
    }
    if (totpCode !== this.totp.currentCode(username)) {
      return { status: 'invalid_credentials' }; // never reveal which part was wrong
    }
    return { status: 'ok' };
  }
}

module.exports = { MfaGuardedLogin };