Supply Chain
Install Script
Also: postinstall script, lifecycle script
Code a package manager runs automatically when a package is installed, such as npm's postinstall.
In more detail
Install scripts run with your user's permissions before you have used the package at all, which makes them a favorite place to hide malware. Many teams disable them by default and allow only specific packages. An agent that installs dependencies triggers them just as you would.