(1) Lockfiles and SBOMs for imgdecode, imgbundle, runhelper, native-runner, img-to-native or cdn-img-fetch; (2) node.exe fetching raw.githubusercontent.com/cavecrew/proj/main/banner.jpg or banner.png; (3) node.exe spawning a suspended dllhost.exe; (4) %APPDATA%\Microsoft\Windows\node_runtime_helper.exe; (5) connections to 104.234.65[.]75:700. Treat any workstation that loaded imgdecode as compromised.