[xx_ns]

It acted as a proxy for the real npm site, which was the one to send the request, intercepting the code when the user inserted it.