GoKawiilAtlassian incident shows SBOMs missed Shai-Hulud worm hidden in transitive dependency
At ISC2 Security Congress 2026 in Denver, Atlassian product security manager Deepam Kanjani described a real incident, with details altered to protect confidentiality, in which a malicious package carrying the Shai-Hulud worm evaded detection despite a matching SHA hash and a credible-looking GitHub repository. The malicious code sat three layers deep as a transitive dependency, so it never appeared in a top-level audit, and the organization's SBOM showed the environment as clean even as a behavioral scanner's warning was initially dismissed as a false positive.
GoKawiil's interpretation of the reporting above, not reported fact.
The account suggests SBOMs can give defenders false confidence because they often catalog declared dependencies without capturing what code actually runs or how deeply buried malicious packages can hide. It implies security teams may need runtime behavioral monitoring and better tracking of transitive dependencies, not just static inventories, to catch supply chain attacks like Shai-Hulud before they spread. The case also hints at organizational risk in dismissing anomaly alerts when other signals, like hash verification, appear to check out.
- A malicious transitive dependency named after Shai-Hulud evaded a company's SBOM and top-level dependency audits.
- A behavioral scanner flagged suspicious activity but was initially dismissed as a false positive since the package's hash matched.
- The SBOM consulted during the incident was outdated by two development sprints, giving a false sense that the environment was clean.
Source: darkreading.com — Jai Vijayan, 2026-10-27
Published there as: “SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.