Add npmjs.com to CSP whitelist.