Developers’ software management apps often favor external code libraries over internal ones, so they download and use the malicious package rather than the trusted one.