Malware may hide in disguised Base64 payloads. Only decode content from trusted sources in production pipelines.

Verify the declared image type matches magic bytes after decode.