All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it
Wow I'm glad I happened to see this here. Thank you for the post. I was just thinking about putting all my services behind a VPN too, I think I'm going to go ahead and put that at the top of the list...