Software Supply Chain
Software Composition Analysis
Also: SCA, dependency scanning
Tooling that lists the dependencies in a project and checks each name and version against databases of known vulnerabilities and known malware.
In more detail
SCA reads lockfiles and manifests, so it only knows what you declare. It is good at the question 'is any version I run on the known-bad list' and weak at brand-new malicious releases that have not been reported yet. It works best next to pinning and install-time scanning.