A component your code needs to run — including the ones your dependencies need (transitive).
When your project installs one package, it usually installs a tree: the package's own dependencies, their dependencies, and so on. A project with 20 direct dependencies routinely resolves to 1,000+ transitive ones — every one a possible entry point for a vulnerability or a supply chain attack.
Package pages on Gold list direct dependencies with their own security status, so you can judge not just the package you choose but the tree it drags in.