JS ecosystem could learn from supply-chain attacks to fix dependency issues, but likely won't change its broken approach.