Glossary
.sppkg file
An .sppkg is the package file that contains a SharePoint Framework solution: its manifests, its API permission requests and its client-side assets. It is a zip file, so you can rename it and open it to inspect exactly what you are about to deploy.
It is uploaded to the tenant's App Catalog, where an administrator decides whether to deploy it to all sites or leave it available site by site.
That it is a zip matters more than it sounds: it means a security review does not depend on the vendor's word. The manifests declare the component ids, whether the solution allows custom script, and every API permission it will request.