The dark figure of supply chain detection

The report argues that signature and string-based detections leave a ‘dark figure’ of undetected supply-chain threats and demonstrates this with a real case: on 2026-08-04 a widely used npm package (Keyv) was flagged for install-time obfuscated execution that downloaded Bun and staged further payloads. It recommends mapping normal package behavior by package type and prioritizing behavioral, technique- and strategy-level detections alongside cheaper IOC rules to catch sophisticated, hard-to-detect malicious packages.