Shai Hulud 2.0: How to Immediately Identify Your Exposure with Arnica’s New SBOM View

Shai Hulud 2.0 is an ongoing supply chain attack targeting the npm ecosystem, identified by researchers as a sophisticated evolution of a previous compromise. The threat actors behind it are publishing malicious npm packages that masquerade as legitimate dependencies. Once installed, these packages can steal sensitive information, execute remote code, or open backdoors within development environments.

What makes Shai Hulud 2.0 especially concerning is its ability to spread quietly. Teams may unknowingly pull the compromised package through transitive dependencies or outdated references buried deep inside large codebases. That means even well maintained repositories can become exposed without an obvious indication that something is wrong.

Spotting Shai Hulud 2.0 Exposure in Seconds with Arnica’s New Package View

The Shai Hulud 2.0 npm attack has shown how quickly a compromised package can spread across an engineering organization. When something like this hits the news, the first question every team asks is simple: where do we actually use this package?

With Arnica’s newest SBOM enhancement, that answer is now available in seconds.

Our updated package-centric view flips the traditional repo-first approach. Instead of digging through dozens or even hundreds of repositories, you can search for any package and immediately see:

• Every repo where it is used
• Every file where it is referenced
• The specific versions in use
• Whether it appears in source code or inside container images

For incidents like Shai Hulud 2.0, this means you can instantly understand exposure and move straight into remediation with no brittle queries, no manual triage, and no guessing.

Combined with Arnica’s automated source code to container image mapping, you will also know whether the vulnerable package actually made it into a deployed image. This closes one of the biggest visibility gaps in modern supply chain attacks and gives security teams the clarity they need at the moment they need it most.

Want to See It in Action?

Use this documentation for a link that will take you directly to the Arnica app to get a list of your impacted packages and versions.

If you want to see how this works using the Shai Hulud 2.0 incident as an example, our team would be happy to walk you through it. Just reach out and we will set up a quick demo.

‍

‍