Didn't your password manager notice that npmjs dot help was not a legit domain and avoid auto-filling there?