This repository investigates software dark matter — software components physically present in artifacts but absent from any declared dependency metadata or SBOM — across four package ecosystems. Each subdirectory is a self-contained analysis pipeline targeting a different artifact format.
Analyzes Docker container images from Docker Hub for untracked filesystem files not claimed by OS package managers (Debian/Ubuntu) or language-level SBOMs. Pulls images, extracts per-layer content, applies multi-stage filtering (general noise, OS packages, language runtimes), performs reachability analysis from the image entrypoint, and detects ephemeral build artifacts that survive into the final image.
Analyzes Jenkins plugin .hpi archives for untracked JARs not reachable from declared Maven dependency graphs. Fetches the Update Center catalog, extracts bundled JARs, resolves their identity, performs BFS transitive expansion through Maven Central, and classifies each JAR as tracked or truly dark. Cross-references dark JARs against exploited library families, models classloader inheritance exposure across the plugin ecosystem, and tracks version-update cadence divergence longitudinally.
Analyzes popular Maven Central artifacts for hidden bundled dependencies introduced via shading (maven-shade-plugin) or JAR-in-JAR nesting. Detects three shading techniques (unrelocation, relocation, suspicious entry names), computes corpus-wide bundling ratios, cross-references dark dependencies against CVE databases, and benchmarks findings against Grype SCA scanner output to measure blind spots in existing tooling.
Analyzes VS Code extensions on Open VSX for undeclared bundled npm packages shipped inside .vsix artifacts. Uses four complementary signals — shipped node_modules/ trees, webpack *.LICENSE.txt sidecars, root-level lock files, and source map sources[] paths — to identify and version-attribute dark packages. Expands declared dependencies through the npm registry to distinguish truly dark packages from expected transitives, then queries OSV.dev for CVEs.