All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it
I don’t know about “all umami instances being infected” but they were certainly all vulnerable.