The dark figure of supply chain detection

What it is

An Aikido Security conceptual piece arguing for how to structure malicious-package detection, not (as the summary implies) a methodology for estimating undetected-threat counts. The core claim: string- and IOC-level rules can only catch attackers who reuse artifacts already seen, so they are structurally blind to the "dark figure" — sophisticated packages that never appeared in tracking data. It adapts David Bianco's pyramid of pain to the package-supply-chain context.

How it works

Two arguments stack. First, string/IOC rules are backward-looking by construction: they match reused payloads, so they miss any attacker who never surfaced (the Wald surviving-bomber analogy). Behavioral rules are the only reach into the unknown, because an attacker still must exfiltrate, execute, and phone home — what they do is constrained even if naming, obfuscation, and destination are not.

Second, behavioral rules are useless without a baseline of normal. An anomalous network call or process spawn only registers as a hole if you have mapped the expected shape. The practical baseline is not one universal model — that doesn't exist — but normal behavior mapped per package type. A build tool spawning child processes and touching the filesystem on install is expected; a string-formatting helper doing the same is not. The article states these categories behave alike across npm, PyPI, and NuGet.

What to do

Run a portfolio across the pyramid, matched to the attacker you're trying to catch:

• Cheap string/IOC rules for the high-volume tier — most malicious packages are low-sophistication with the same payload copied across a wave. A throwaway rule catches the wave, "dies young" when the attacker rotates, and is rewritten just as cheaply. This is the cheap tier working as intended, not a failure.
• Expensive technique/strategy-level rules at the top of the pyramid — the only reach into the sophisticated few. These require a real behavioral baseline or they don't function.
• Build that baseline by capability-based package categorization (build tool vs CLI vs web framework vs pure-function utility), then flag behavior inconsistent with the category.

flowchart TD
    A[Malicious package] --> B{Reuses known artifact?}
    B -->|Yes| C[Cheap string/IOC rule catches it]
    B -->|No: the dark figure| D{Behavior deviates from<br/>package-type baseline?}
    D -->|Baseline exists| E[Behavioral rule catches it]
    D -->|No baseline| F[Invisible — looks like noise]

Caveats

• The piece is a framework/argument, not a tool release, benchmark, or dataset — it gives no detection rates, no "dark figure" size estimate (despite the title), and names no product feature.
• It concedes demanding an expensive behavioral baseline for threats a five-minute string rule already stops is inefficient; the tiers are complementary, not a replacement.
• The fetched text cuts off mid-sentence while describing cross-ecosystem category consistency, so any concrete implementation detail beyond the categorization principle is absent.