Disable Windows script host
Were there ever any reasons for a Windows Home user to run a .js or .jse file?
Just set Windows to block it :https://blog.f-secure.com/how-to-disable-windows-script-host/
I smugly thought I'd already done this, turns out it was on a previous PC. Oops.