Didn't your password manager notice that npmjs dot help was not a legit domain and avoid auto-filling there?
https://news.ycombinator.com/item?id=45175125