Dynamic Threat Analysis for Container Images

Aqua Security details the risk of malicious code hidden inside container images and OSS packages that evade static scanners and activate only at runtime, giving examples including a Docker Hub crypto-miner image (jzulu/xauto) and a credential-stealing Python package ('jellyfish'). The report presents Aqua's Dynamic Threat Analysis sandbox, which runs images in isolation to observe runtime behaviors (dropped/base64-encoded binaries, network activity, TOR usage, credential reads) and assess risk before images are deployed.