The n8n-nodes-mcputils npm package version 0.1.5 is a malicious package masquerading as a community node for MCP utility helpers. It executes unverified binaries from third-party hosts during installation and runtime, performing unauthorized actions unrelated to its stated purpose. This behavior compromises the host system, potentially granting full control to attackers. Immediate removal and secret/key rotation are advised for affected systems.