So I left a nodered instance running on my VPS the other day wide open to the world with authentication disabled. Big surprise, in a couple weeks the CPU started running at 100% permanently.