A package hijack is the unauthorized publishing of a software package version or replacement of a legitimate version with a malicious one. It abuses trust in package names, maintainers, or release channels rather than necessarily breaking into each system that installs the package.
In an attack, a stolen publishing credential or compromised maintainer account may let an intruder upload a tampered release. Developers and automated build systems can then pull it as an ordinary dependency, potentially running malicious code during installation or use. Defenses include protecting and limiting publishing credentials, requiring strong multi-factor authentication and approval controls, scanning repositories for exposed secrets, and reviewing unexpected package versions before deployment.