I bet sites have some sort of control over those rules but I have seen it happen randomy with other sites too. It can be super annoying.

Not sure why NPM is more hostile with tor users but it really isn't uncommon. I have only had to deal with it with Google searches but it is so frustrating.

Now that I think about it, 20 prompts is excessive. I wonder if the root issue is actually just a javascript call getting timed out because of latency over tor? That would make more sense to me because If I was integrating some challenge like that I would cap it off at like 3 or 4 to validate it is a human.