The npm package @years18/n8n-nodes-utils-helper-d version 1.0.0 contains malicious code executed during installation. The postinstall script downloads and runs a remote Python-based DDoS tool, leaks system identity and network information to an attacker-controlled server, and performs internal network reconnaissance consistent with lateral movement preparation. The malicious payload is also executed when the module is required.