Malicious npm packages bypass macOS defenses entirely. How supply chain attacks hit Mac developers, orgs, and everyday users — and why you're exposed.