The ChainDrop npm supply chain attack compromised 444 packages and 2 billion monthly installs in 4 hours. Here's how it worked and what developers must do now.