Relying solely on a software bill of materials to manage security risks can leave organizations vulnerable when malicious packages bypass initial checks. During the International Information System Security Certification Consortium Security Congress 2026, experts highlighted how such gaps complicate incident response efforts, according to coverage from Dark Reading.
Atlassian product security manager Deepam Kanjani detailed a real-world compromise involving the Shai-Hulud worm to illustrate the dangers of hidden transitive dependencies. The malicious package appeared legitimate, featuring a credible repository and high engagement metrics, which allowed it to evade standard security audits.
Because the threat was buried three layers deep, it remained invisible to top-level dependency scans. When the attack occurred, responders struggled because their software bill of materials was outdated, and they lacked the runtime telemetry necessary to track the code execution across more than 400 services. The incident underscored that security teams must prioritize real-time visibility into production environments rather than static dependency lists.
Kanjani recommended that organizations maintain software bill of materials data that is less than 72 hours old and implement runtime detection for unknown module loads. Ultimately, the session emphasized that defenders should focus on identifying malicious operational behaviors rather than attempting to attribute attacks to specific threat actors, as identity signals are easily manipulated.
Source: Dark Reading
