• Web/proxy logs: POST /flows to Node-RED (default port 1880) from outside your management network, especially with curl, python-requests or Python-urllib user agents. A 200 response with a new rev hash means the flow was accepted.
• Flow contents: an inject node with once: true wired to an exec node whose command is echo <base64> | base64 -d | sh; or an http in node (e.g. /cmd or a random path) wired through a function node to an exec node with addpay enabled. Diff your current flows.json against a known-good copy.
• Host artifacts: /dev/shm/.b, /tmp/.s, /tmp/.kworker; processes started via setsid or nohup as children of the Node-RED process; wget/curl spawned by node.
• Network IoCs (VulnCheck): source 4.201.105[.]116; payload servers 85.215.73[.]250:8080 (/bot-linux-amd64, /wget.sh) and 45.194.90[.]57:38472 (/.sys_update).

A /dev/shm implant disappears on reboot, but webshell flows persist in flows.json, so rebooting is not cleanup. Remove the rogue flows, enable adminAuth, then rotate any credentials stored in Node-RED's credential file.