Safe Chain: Stopping Malicious NPM Packages Before They Wreck Your Project