# Node-RED compromise hack

**URL:** <https://discourse.nodered.org/t/node-red-compromise-hack/82257>\
**Category:** General\
**Tags:** security\
**Created:** [22 October 2023 14:40 UTC](https://discourse.nodered.org/t/node-red-compromise-hack/82257 "2023-10-22T14:40:31Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [22 October 2023 15:00 UTC](https://discourse.nodered.org/t/node-red-compromise-hack/82257/3 "2023-10-22T15:00:36Z")

</div>

This is:

[TrojanDownloader:Linux/Morila!MTB](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Linux/Morila!MTB)

As it has likely run on that system, the system is compromised and likely requires a complete rebuild.

Title changed as a hack is confirmed.

* * *

A strong reminder to all who come across this post:

# DO NOT EXPOSE YOUR NODE-RED SERVER TO THE INTERNET UNLESS YOU KNOW WHAT YOU ARE DOING

It WILL be compromised.

---

_[View the full topic](https://discourse.nodered.org/t/node-red-compromise-hack/82257)._