More than a dozen npm packages with two billion downloads a week were compromised in a supply chain attack that targeted cryptocurrency users.