It was an exploit related to @npub1geta...0nfm hub. Their installation page requires 0 authentication and gives access to the entire node. They call it good UI.