If you have not at least setup user/pwd access to your node-red then there is a good chance it has already been hacked, so you may need to rebuild your system.
After you have stopped the port forwarding and stopped node-red (as it may now be running flows that go out over the internet, mining crypto etc) then see this FAQ post for advice on how to safely access node-red over the internet.