Turns out it was @cloudflare's DDOS protection in combination with invalid
headers sent by npm:
https://github.com/npm/cli/issues/836#issuecomment-587019096
https://twitter.com/npmstatus/status/1229387982068543488