The original PAM RFC defines PAM as Pluggable Authentication Modules (plural – it’s the name of the framework and not one of its components), so it’s fine and more natural to say “PAM module”.