A trojanized package is a legitimate-looking software package that has been altered to include malicious code. It may keep the original name, version style, or project branding, which helps it blend into normal dependency installation and update workflows.
This matters because package managers are trusted distribution channels: developers often install code with elevated access to build systems, secrets, and signing keys. A trojanized package can steal credentials, open a backdoor, or run commands during install, test, or post-install hooks. In attacks, adversaries may abuse a maintainer account, upload a poisoned release, or publish a near-match package to trick users. Defenders reduce risk by verifying package provenance, using MFA on publishing accounts, pinning versions, reviewing dependency changes, and isolating untrusted builds in disposable environments.