Malicious library execution is a supply-chain attack pattern where harmful code runs after a user installs a package or library that appears legitimate. The code is delivered through normal developer tooling, so the install may look routine even though it brings malware with it.
This matters because package managers are trusted entry points in software development. Attackers abuse typosquatting, dependency confusion, or compromised package accounts to place malicious libraries in the path of developers and build systems. Once executed, the payload may steal browser credentials, session tokens, API keys, or crypto-wallet secrets, turning a simple install into account compromise or financial loss.