Supply Chain
Malicious Package
Also: malware package, trojanized package
A published library that contains code meant to steal data, install malware or damage the systems that use it.
In more detail
Public registries such as npm and PyPI accept uploads from anyone, so attackers publish look-alike names, hijack real maintainer accounts or add a payload to an update. Typical payloads steal environment variables, tokens and SSH keys during install. Scanning new dependencies before they are used, and delaying adoption of brand-new versions, catches many of them.