Supply Chain
Typosquatting
Also: name squatting
Publishing a malicious package whose name is a small misspelling of a popular one, hoping someone installs it by mistake.
In more detail
A single swapped letter in an install command is enough. Agents are especially exposed because they type install commands quickly and do not notice a near-miss. Registry lookups, allowlists of approved packages and lockfiles reduce the risk.