SBOMs missed scope of a Shai-Hulud supply-chain compromise
Original title: SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A stale SBOM called a SaaS environment clean while a hidden transitive dependency had already run.
At an ISC2 Security Congress 2026 session, Atlassian product security manager Deepam Kanjani described a Shai-Hulud supply-chain incident in a large SaaS environment. A credible-looking package with a matching SHA hash pulled in a malicious transitive dependency named shai-hulud that a top-level audit did not show. Responders first treated a behavioral alert as a false positive, and the SBOM they checked was two development sprints out of date.
Unconfirmed: Kanjani said identifying details, figures, and the sequence were altered to protect confidentiality.
- The malicious dependency sat three layers deep and was named shai-hulud.
- The parent package had more than 3,400 GitHub stars and a matching hash.
- A behavioral scanner flagged unexpected execution before the team accepted the alert.
- Kanjani said he altered identifying details, figures, and the event sequence.
Impact: Malicious dependency executed inside a large SaaS environment
- 1.Use runtime visibility into executing code and services, not only SBOMs, during supply-chain response.
- Vendors
- Atlassian
- Malware
- shai-hulud
- Organizations
- ISC2
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0976de79337ac3812bd4e8604cb04c0d | er-ransomware-activity#recipe=similar-items&sourcecontentid=0976de79337ac3812bd4e8604cb04c0d) US Cyber Pros Plead Guilty Over BlackCat Ransomware Activ |
| md5 | 3de05debc69bdf840acf3ce3c6457ee8 | e-getting-more-violent#recipe=similar-items&sourcecontentid=3de05debc69bdf840acf3ce3c6457ee8) How Can CISOs Respond to Ransomware Getting More Violent? |
| md5 | 842bd5a84d1f4b7738c164d8542426b4 | mminent-threat-act-now#recipe=similar-items&sourcecontentid=842bd5a84d1f4b7738c164d8542426b4) Microsoft Exchange 'Under Imminent Threat,' Act Now by Ar |
| md5 | dd763fcf1c8714815d52f82a2a0d8a90 | cyber-strategy-changes#recipe=similar-items&sourcecontentid=dd763fcf1c8714815d52f82a2a0d8a90) Switching to Offense: US Makes Cyber Strategy Changes by |
From the original article
7 min read at darkreading.com
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.