they managed to get RCE through a vulnerable npm package i think. Downloaded a file called 'server' and from that probably got root access. I am still able to login myself, im going to wipe the server, patch the npm package and hope that doesnt happen again