A maximum-severity hole in Node-RED's HTTP interface is now drawing working exploits that end in a memory-resident bot.