GoKawiilAtlassian incident shows SBOMs missed Shai-Hulud worm hidden in transitive dependency
At ISC2 Security Congress 2026 in Denver, Atlassian product security manager Deepam Kanjani described a real incident, with details altered to protect confidentiality, in which a malicious package carrying the Shai-Hulud worm evaded detection despite a matching SHA hash and a credible-looking GitHub repository. The malicious code sat three layers deep as a transitive dependency, so it never appeared in a top-level audit, and the organization's SBOM showed the environment as clean even as a behavioral scanner's warning was initially dismissed as a false positive.