Comment by grekowalski

Recently, those Monero miners were installing themselves everywhere that had a vulnerable React 19. I had exactly the same problem.