The "biggest supply chain attack" in the history of npm took place recently, affecting almost two dozen packages.