“Over four million of the repositories in Docker Hub are imageless and have no content except for the repository documentation.”
JFrog found 4.6 million Docker Hub repositories with no container in them, and 2.81 million were landing pages for pirated software, malware and card phishing. Some campaigns created thousands of repositories a day for two and a half years. The attackers used 208,739 fake accounts. Docker took them down only after JFrog disclosed them. Five years of bot spam on the registry, and someone else had to find it.