Your node-red is open to the internet and is accessible via http.
You really need to secure this page using https and insure you password is very strong. It will not take long to sniff your password if you remain with no TLS encryption. please sort this issue as soon as possible.
I advise that you disconnect your node-red from the internet until you have fully secured with encrypted https the connection Safely accessing Node-RED over the Internet