Have I been hacked?

[marcus-j-davies]

Yup!

You have been had, by the same reported here, this suggests you had an unauthenticated Node RED instance being made public?

Node-RED compromise hack

This is: TrojanDownloader:Linux/Morila!MTB As it has likely run on that system, the system is compromised and likely requires a complete rebuild. Title changed as a hack is confirmed. A strong reminder to all who come across this post: DO NOT EXPOSE YOUR NODE-RED SERVER TO THE INTERNET UNLESS YOU KNOW WHAT YOU ARE DOING It WILL be compromised.