The package was directly compromised, not “by supply chain attack”.

If you use the compromised package, your supply chain is compromised.