Especially in this case where the attackers could've proxied you to their malicious servers through npp's good/trusted servers