What a coincidence. I also received a similar email and upon investigating, found the same Monero mining on my server. Tried rebuilding the image, but same thing was poping up. Then I did a npm update and that fixed everything!