Just thought I'd share a little experience I had yesterday regarding a Crypto Miner I discovered inside my Node-Red. I have Node-Red in a Docker Container and noticed my server CPU usage spiked to nearly 100% full-time. Upon researching the cause, I saw the responsible process was /var/tmp/sustes -…

How did you get 'infected', was it a rogue flow/node?

Just to add a key missing piece of information here .. this was a node-red instance exposed on the internet with no security applied. This is why we always go to great lengths to highlight the security implications of exposing NR to the internet. The exec node gives whoever can deploy a flow comple…

Here is the added information. I did in fact have Node-Red under a Reverse Proxy (NGINX) with BasicAuth user/password. Unfortunately, I did NOT close the Port for Node-Red.....so that is definitely a wide-open attack vector (stupid me). This is why I said "highly likely my own problem and not wide…

[image] stupifier: Node Red definitely is a well-known target to attack now That is certainly the part that is interesting to me. That there are bad actors out there with Node-RED knowledge! Long timers will know that security is something that I bang on about. Hopefully this is another wake…

Also that the inject was not set to auto run, so they had to click it.

In addition to configuring adminAuth, I have also configured open VPN and only opened the port on my home LAN router for vpn access ... so this properly secures my home LAN from the outside world while I can still access it from my smart phone and laptop anywhere in the world.

[image] janvda: In addition to configuring adminAuth, I have also configured open VPN and only opened the port on my home LAN router for vpn access ... so this properly secures my home LAN from the outside world while I can still access it from my smart phone and laptop anywhere in the world. …

I'm on a Hetzner physical server......That Digital Ocean post was just something I found on the internet to help me diagnose and treat my problem. I am not using anything from Digital Ocean.

[image] stupifier: physical server OK, well if that is on a local network you control then setting up a VPN may be useful. Too many variables to say for sure. For example, we don't know if you are on a corporate network or a home network.

Node-RED

Node-RED Forum

Crypto Miner Abuse/Malware

General

krambriw 25 September 2018 05:25 11

Better you quickly check all the other computers (if any) that you have on the same network

Topic		Replies	Views
⚠️ Malware Infecting unsecured Node-RED servers News	2	2197	12 March 2019
Node Red starts mining Monero coins without my consent! General security	34	408	28 July 2025
Malware found in node-red project General security , docker	33	662	5 December 2025
About unsecured instances of Node-RED having a crypto-mining flow automatically deployed General	4	949	21 January 2019
Cryptomining Malware Infecting Node-RED servers General	14	4011	28 January 2019

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Crypto Miner Abuse/Malware

Related topics