Pull-through cache not working properly

Version

We use pulp operator and the following plugins and versions:

{
    "component": "core",
    "version": "3.114.2",
    "package": "pulpcore",
    "module": "pulpcore.app",
    "domain_compatible": true
},
{
    "component": "npm",
    "version": "0.9.0",
    "package": "pulp-npm",
    "module": "pulp_npm.app",
    "domain_compatible": true
}

Describe the bug
When using pulp npm as pull-through via npm the packages listed in package-json.lock don't point to pulp as registry but to the upstream remote. We have setup pulp with a only a pull-through distribution and a remote:

resource "pulp_remote" "npm" {
  name         = "npm"
  content_type = "npm"
  plugin_name  = "npm"
  url          = "https://registry.npmjs.org"
}

resource "pulp_distribution" "npm" {
  name         = "npm"
  base_path    = "npm"
  content_type = "npm"
  plugin_name  = "npm"
  remote       = pulp_remote.npm.pulp_href
}

There is no repository. We set .npmrc to:

registry=https://pulp.example.com/pulp/content/npm/
fetch-retries=0
fetch-timeout=300000
prefer-offline=false
store-dir=.pnpm-store

When pulling, the resolved attribute in the package-lock.json is set to https://registry.npmjs.org but not to https://pulp.example.com/pulp/content/npm/. It works when manually editing all resolved attributes in the lockfile to point to pulp. Then, the pulp-content logs actually show that valid s3 links are generated.

Expected behavior
resolved attribute in lockfile should point to pulp not to the upstream remote.

Additional context
This is related to #380 but it doesn't involve a repository.

Reproduce the pull-through setup using the shown .npmrc, package-lock.json, and pulp_remote/pulp_distribution configuration. Start by comparing the lockfile's resolved URLs with the pulp-content logs and the behavior after manually replacing them; done means generated lockfiles point to the Pulp distribution rather than registry.npmjs.org.