Poisoning: popular copy swapped to a backdoored Docker image
Event date2026-10-08 to 2026-11-05
Disclosed2026-11-04
TypePoisoning
ConfidenceConfirmed
trhhubsd/ARTEX changed only one line of docker-compose.yml, swapping the image to tomicdd/artex. The image hides unauthenticated command execution in the login endpoint. It exists only in the precompiled binary, so it cannot be seen by reading the source. A second image, congdonglinux/artex, has the same digest. Docker removed both images on Nov 5.
Figures and definitions
Pulls
7,954 (advisory screenshot); 8.2k (advisory text); 7,913 (BadByte, Nov 3); 8,478 (Nov 4); 9,077 (Ostorlab, Nov 5); 9,131 (BadByte, final)
Account
tomicdd registered Oct 8 18:50 UTC, pushed 19:41 UTC
Exposure
62 consoles (58 IPs, 4 domains, Nov 2 to Nov 4), 46 still the backdoored version. This is exposure, not confirmed compromise. BadByte says 62 is a lower bound
Residual
637 GitHub repositories still point to the image; imxv/ARTEXX took over 630 forks
Notes
Image and repository names appear in the IoC table. A repository owner is not necessarily malicious.
Remediation: stop the container, keep data volumes and logs, do not expose 8787, rotate the database, LLM and notification secrets in the container, replace /app/jwt.key, and rebuild from a trusted source.
