Modern software supply chains have evolved into vast, heterogeneous networks where transparency - the granular understanding of all software components - is now a critical security requirement. While Software Bills of Materials (SBOMs) have emerged as the primary mechanism for this transparency, current industry practices rely on a metadata-centric paradigm that assumes an artifact is defined solely by its package manager declarations. We posit that this assumption is fundamentally flawed, creating a systemic visibility gap we define as Software Dark Matter (SDM). SDM represents the set of security-critical files present in an artifact's filesystem that are unaccounted for by its associated metadata. We implement a reference tool, DARKFILES, and use it to analyze four ecosystems of disjoint nature: DockerHub, Maven Central, plugin/extension marketplaces (Jenkins plugins and OpenVSX), and a real-world enterprise environment. Our research makes the following contributions: we introduce a general-purpose metric for artifact fidelity calculating SDM as the ratio of untracked files per total file count. We introduce Packaging Lag, a phenomenon where official metadata remains out-of-date across multiple versions before catching up to an artifact's actual content. We demonstrate that SDM exposes vulnerable software invisible to SBOM-driven pipelines both by cross-referencing untracked packages against known CVE databases and through the direct discovery of three confirmed high-severity CVEs, showing that SDM is highly correlated with sensitive information including secrets and cryptographic keys.

翻译：现代软件供应链已演变为庞大且异构的网络，其中透明度——对所有软件组件的细粒度理解——已成为关键的安全需求。尽管软件物料清单（SBOM）已成为实现这种透明度的主要机制，但当前行业实践依赖于以元数据为中心的范式，该范式假设一个工件仅由其包管理器声明定义。我们认为这一假设存在根本性缺陷，造成了一个系统性可见性缺口，我们将其定义为软件暗物质（SDM）。SDM代表工件文件系统中存在的、但未被其关联元数据记录的安全关键文件集合。我们实现了一个参考工具DARKFILES，并利用它分析了四个性质迥异的生态系统：DockerHub、Maven Central、插件/扩展市场（Jenkins插件和OpenVSX）以及一个真实的企业环境。我们的研究做出以下贡献：我们引入了一个通用工件保真度指标，通过每个工件中未追踪文件数与总文件数之比计算SDM。我们提出了“包装滞后”现象，即官方元数据在多个版本中持续过时，直至最终追上工件的实际内容。我们证明，SDM暴露了对SBOM驱动流水线不可见的易受攻击软件，这既通过将未追踪包与已知CVE数据库交叉引用实现，也通过直接发现三个已确认的高严重性CVE实现，表明SDM与包括密钥和加密密钥在内的敏感信息高度相关。