The npm package @years18/n8n-nodes-utils-helper-f version 1.0.0 contains malicious code executed during installation. Its postinstall script runs shell commands to gather host information, probes an internal network address, and exfiltrates data to a remote server with disabled TLS verification. It also downloads and runs a Python-based DDoS framework, effectively turning the installing machine into a node for distributed denial-of-service attacks.