Crypto firms rushed to assess risks after a major supply chain attack planted malware in JavaScript packages.