Comment by mfkp

Seems like it actually loads a PNG image now, maybe the npm script adds some additional headers to trigger the payload.