The npm package @years18/n8n-nodes-utils-helper-c version 1.0.0 contains malicious postinstall code. Upon installation, it downloads and executes the MHDDoS attack tool without TLS verification, and exfiltrates system reconnaissance data encoded in base64 to a remote server. These actions are unrelated to the package's intended functionality and pose a security risk to users who install this package.