The existence of index of password txt install is a symptom of a larger disease: poor credential hygiene.

Modern best practices mandate:

Delete password.txt and any similarly named files (admin.txt, creds.txt, dbpass.txt). Use rm on Linux or delete via FTP.

Installation directories should never remain on a production server. Run:

rm -rf /var/www/html/install/

If you genuinely need the directory, password-protect it using .htaccess or basic auth.