Software Supply Chain
Maintainer Account Takeover
Also: publisher account compromise, account hijack
Taking over the registry or source-hosting account of someone allowed to publish a package, then publishing a malicious release as them.
In more detail
The release looks legitimate because it comes from the real owner, so name checks and download counts do not help. Attackers get in by stealing tokens from infected machines, phishing, or reusing leaked credentials. Defences are two-factor authentication, short-lived publishing credentials and publishing only from a reviewed pipeline.