Much prefer the Broccoli2Shell name & site (for the same vuln): https://broccoli2shell.com/. For starters, I'm pretty sure you can hit this without HTTP if you do any manual Brotli decoding, HTTP just happens to be the most common case that comes up.
Ok, we've belatedly changed to that from https://www.aikido.dev/blog/python-packages-vulnerable-node2.... I'll put the other link in the top text as well.
What about merging up with the already ongoing discussion which needed a url cleanup anyways https://news.ycombinator.com/item?id=50216791