Supply chain attacks in the npm ecosystem occur through various vectors such as typo-squatting, dependency confusion, and hijacked packages. Attackers publish malicious code in packages with similar names to popular ones, register public packages with names used internally by companies, or gain control of popular packages to insert malicious code.