Supply Chain
Package Worm
Also: self-propagating package, npm worm
Malicious package code that steals publishing credentials from each victim and uses them to infect more packages automatically.
In more detail
A worm turns every compromised developer into a distribution channel: it finds npm or similar tokens on the machine, publishes infected versions of the victim's packages and repeats. Short-lived publishing credentials, provenance checks and install-script restrictions slow the spread.