With the SSH/NPM supply chain attack, we all live in fear now. It just need one very smart person to deploy such hack. I'm not saying hotio did something, all I am saying that with new information, we all should check our deployment. Along with OP I'm affected, where I never have exposed the docker to world ever.

So we should not deny the possibility of something off here.

You aren’t affected though… the output you posted clearly shows the only response to that process grep was your own grep…