How does it manage to hide the requests to 127.0.0.1 from the network tab?
If you're on OSX, the permission to "discover on the local network" prevents it from happening ( System Settings -> Privacy & Security -> Local Network -> yourbrowser )
Could also be 'network' permissions on firefox ( Go to Settings > Privacy & Security > Permissions ) which is on a per site level, but iirc that could be set site-wide at some point.
The other browsers likely have similar configs, but this is what I have found.
But I found what "burp" is: https://portswigger.net/burp/communitydownload
Somewhat more worryingly, Little Snitch doesn't report them at all, though that might just be because they were already blocked at the browser.
That looks so much like test code that was shipped to prod.
Searches for that string on GH does return results.