Despite compromising packages used across the industry, the attacker netted just $0.05, as well as an attention-seeking memecoin donation.