A miner turned up in a we-mp-rss container: what now for WeChat RSS? (2026)
On 2026-10-31 a user found a mining process in a we-mp-rss container, using about 7 CPU cores; how it got in is not established. To stop running a container and scanning a code, an Official Account's latest articles come from one call at $0.0200, and you make the RSS from those. DataXAPI reads WeChat Official Accounts with 8 endpoints, from $0.0200 a call; a failed call is not charged, and the free trial covers up to 333 calls.
The report describes a process at /tmp/hash, along with mining files, start-up scripts and an unknown SSH key, none of them part of a normal start. Its author writes that the way in could not be confirmed, and that this does not show the flaw is in the project's own code.
Its advice to others: until the cause is known, stop the instance or take it off the public internet; check /tmp, /root/.ssh/authorized_keys, /etc/rc.local and unknown processes; do not just kill the miner and keep the container.
Keeping the RSS without the container
An RSS feed is a list of an account's latest articles. Call the article list once a day for each account and write the feed from the answer. 10 accounts are 10 calls at $0.0200: $0.20 a day. There is no WeChat login and no server of yours open to the internet.
The public repository data-x-api/wechat-rss is a working example of this, with no Docker and no code to scan.
Why DataXAPI
Steady: endpoints were available 99.9% of the last 30 days, on a public status page you can check.
Fast: a paid call took 3.5 seconds at the median over the last 7 days (counted 2026-11-06).
Fewer tokens: across 8 endpoints on WeChat Official Accounts, one recorded real response each, the platform's own JSON comes to 21k tokens and what an AI reads through DataXAPI's MCP server to 4,494, 79% fewer; the JSON of a direct API call is 70% fewer too (counted 2026-11-06). Every platform answers in one shape: the author in author, counts in metrics, the next page in page.next_cursor, so another platform needs no new parser.
See before you pay: every endpoint's page shows a recorded real response, field by field.
Spending you control: a failed call is not charged; each key can have a limit, X-Max-Price caps one call, and the same Idempotency-Key within 24 hours is never charged twice.
Ready for AI: a remote MCP server listed in the official MCP registry as com.dataxapi/mcp, usable from Claude, Cursor and ChatGPT.
Free trial of up to 333 calls, no card.
Endpoints
Each with its price; every page has the parameters, the fields and a recorded response.