Only Copay is affected by this vulnerability.
Although the package was included by many, many projects (both within and outside the crypto space), the attack payload was encrypted, and used the package description as a decryption key. They key in question was found to be (via brute force)
A Secure Bitcoin Wallet, which is the npm description for the copay-dash package.
Thus, packages which did not have that as their description would be unable to decrypt, and hence execute, the payload.
Note that such attacks are feasible on any package that does not verify and pin its dependencies, even outside the nodejs ecosystem. Developers should work to ensure that they are importing vetted code, and pin (or even vendor) their dependencies. This is especially important for programs that deal with private keys.