There are two commands:
sfdx force:package:create --name "MyApp" --description "MyApp" --packagetype Unlocked -r force-app
sfdx force:package:version:create --package MyApp --installationkey securepassword --wait 20
Package Installation URL: https://login.salesforce.com/packaging/installPackage.apexp?p0=xxxxxx
As I understand it the first command creates a package from my project (updating the project json file) and the second one pushes it the Salesforce servers with a password for access.
Where is this package hosted? Is it on our dev hub? Or is it somewhere anyone in the world could install it if they had the url and the password?