Software Supply Chain
Transitive Dependency
Also: indirect dependency, nested dependency
A dependency you never asked for by name, pulled in because one of your own dependencies needs it.
In more detail
If your project depends on package A and A depends on B, then B is a transitive dependency. You did not choose it, you may not know it exists, and an attacker who compromises B reaches you anyway. Lockfiles and SBOMs exist largely to make this hidden layer visible.