A major JavaScript supply-chain attack has compromised hundreds of software packages — including at least 10 used widely ...