If a directory contains a file named new_passwords.txt or updated_creds.csv , an attacker gains instant access to live user accounts, administrative panels, databases, or SSH keys.
Using or being a target of such queries involves significant risks: Re: Index Of Password Txt Facebook - Google Groups index of password new
Attackers use this query to target directories that might contain sensitive "new" password lists, configuration files, or database backups that have been accidentally left public. The Security Risk of Directory Indexing If a directory contains a file named new_passwords