Package hijacking is an attack on software supply chains where an attacker gets a legitimate package name to publish a malicious version under that trusted label. The attacker may steal a maintainer account, exploit a publishing mistake, or abuse an automated release path so the registry accepts a fake update as if it were normal. Because package names already carry trust, downstream developers and build systems may install the poisoned release without noticing.
This matters because package managers are often part of the production path. A hijacked package can spread malware, steal secrets, or backdoor applications through ordinary dependency updates. Defenses include strong account protection, short-lived CI/CD credentials, restricted publishing permissions, package pinning, release-diff review, and provenance checks. Even with trusted publishing, teams should verify that the workflow, repository, and package name are tightly bound so only the intended maintainer can ship a release.