Turns out it was @cloudflare's DDOS protection in combination with invalid headers sent by npm: https://github.com/npm/cli/issues/836#issuecomment-587019096 https://twitter.com/npmstatus/status/1229387982068543488