A Python supply chain attack refers to situations where malicious actors compromise a project not by altering the code directly but by tampering with an element the project relies on, such as a package from PyPI or a build pipeline. By the time the installation occurs, the malicious code is integrated into the dependency graph, treated like any legitimate package.