Is this normal practice?

I purchased a third party module.  It has a number of problems.  I emailed the developer and they are asking for my login credentials (both admin and cpanel) to fix the issue. 

Is this normal practice? 

Yes.

Quite often differences in your server config, or the modules you have installed can cause problems with some modules. To find and fix many of those issues with a module, access is needed.

However before doing so, you need to change your passwords. Never give a developer your normal passwords. Once the developer is done, change the passwords again.

This is very normal...

Thank you both.