How Cloudflare’s client-side security made the npm supply chain attack a non-event