Comment by baobun

Supposedly this image.

https://github.com/hotio/qbittorrent/pkgs/container/qbittorr...

Based on https://github.com/hotio/base

Should be tracable via GitHub Actions logs for anyone signed on - if it is indeed supply-chain and not a qbittorrent exploit or something else.