Ledger’s CTO said a massive npm supply-chain attack from Monday failed with only about $503 stolen before detection halted the spread.