Unexpected flow restart with lost of context files & tokens (google and telegram)!

General
1

Node-red 4.1.2

My flow randomly restart (each 2 or 3 days) and then all the context files are deleted (the variables are not re-written).

Furtherlore the tokens field for telegram and google are blank.

Is there a log file that could provide an indication why the flows restart?

Remark: If I restart the flows by myself everything goes fine; the context variables are correctly initialized and the tokens not lost

flow restart
flow restart1315Ă—471 32.3 KB

missing token
missing token1321Ă—480 14.6 KB

2

Welcome you the forum.
We need to see what comes before the restart.

3

It is probably in /var/log/syslog

4

There is no syslog in /var/log but I can read the log with journalctl command.

I don’t see anything that can explain the restart of the flows (see the screenshot in my initial request).

Actually I suspect node-red-contrib-googlehome to be the root cause. I have just deleted all the nodes relying on this palette and wait if the problem comes again

5

Find the node red start and see what comes before it.

6

Looking at the journalctl trace, nothing special seems to happen before the flows stop.

Capture d’écran 2026-01-09 194848
Capture d’écran 2026-01-09 1948481071×882 29.4 KB

7

In future please copy/paste logs, not screenshot.

image

That is the result of a Deploy. If it wasn't you then, if your system is open to the internet, then you have been hacked. Disconnect the system from the internet and stop node-red.

1 Like
8

image
This looks to me like evidence of malicious cron jobs.
Unless you intend to fetch and execute bash scripts from that site, I too think you have been hacked.

1 Like
9

Yes, you are right. I missed that. Unless @sebamelo is doing something rather unusual then his machine has been well and truly hacked. Not just messing with node-red but also adding cron jobs.

@sebamelo I think you need to recreate the SD card on the pi and start again. Hopefully you have got a backup of your flows from before the hack. Also you need to consider the possibility that other machines on your network may have been infiltrated from the pi.

See this FAQ post for advice on how to safely access node-red over the internet.

10

@sebamelo will you please tell us if your Node-red machine has ever been accessible from the internet (by you or anyone)?

If it has been, how did you set it up?
Does the user raspberrypi have the right to run sudo, with or without a password?

The hacker has made multiple changes to your computer, not confined to Node-red. You will have to reinstall the entire operating system from scratch.

The download site seems (in chatgpt's opinion) to be on Cloudflare. Perhaps they would be interested to know they are serving cryptomining code for hackers.