A package registry is a public, trusted repository of open source packages on the internet: npm for JavaScript, PyPI for Python, crates.io for Rust. When you install a library, your package manager is asking a registry for a specific package at a specific version, and getting back everything that package depends on too.
The "trusted" part carries a lot of weight. Nearly all modern software leans on registries by default, which makes them worth attacking — publish something malicious under a name close to a real package and you get installed by people who typed too fast.
