And the fun part there is that this image is effectively a workaround - node.js 20 is installed via curl | bash. That means CVE scanners and SCA tools can miss node itself in that image.

As silly as it sounds, try running "snyk container test --print-deps" on that image, and look around for Node.

This approach works fine, but means that you might not be able to rely on most container security scanners to let you know when there's an issue.