This bug regarding npm's bash completion script clobbering
$COMP_WORDBREAKS has been fixed and committed upstream. According to
Forrest L Norvell (@othiym23)
replying to the the corresponding upstream GitHub issue #4530 "Shell
completion script breaks bash's environment variable assignment
filesystem path completion":
There is a fix landed to the completion script in d7271b8 
– the lib/utils/completion.sh included in the tree at that
version (which will be part of the next npm@2 release,
coming out later tonight as npm@next) fixes this issue.
The fix has been pushed to the @latest email@example.com,
which can be fetched by a simple "npm install npm".
Please consider upgrading to 2.13.5 (See also Bug#794890),
or at least fetch the lib/utils/completion.sh therein and
put it in Debian's current npm-1.4.21.