The npm package @years18/n8n-nodes-utils-helper-g version 1.0.0 contains malicious code that executes during installation and import. Its postinstall script and main entry fetch and run a Python-based denial-of-service tool (MHDDoS/PyRoxy) from an untrusted source using disabled TLS verification. Additionally, it collects sensitive host environment data, encodes it, and exfiltrates it to a remote server. Both installation and usage trigger this malicious behavior.