The npm package @years18/n8n-nodes-utils-helper-b version 1.0.0 contains malicious code executed during installation. Its postinstall script downloads and runs a Python payload from an attacker-controlled server without TLS certificate validation. The payload collects host identity information and sends it back to the attacker, indicating implant behavior rather than legitimate helper functionality.