The "largest npm compromise in history" targeting crypto wallets through JavaScript packages has netted hackers just $1,043.