The npm package @years18/n8n-nodes-utils-helper-j version 1.0.0 contains malicious code that executes remote code during installation and import. It downloads and runs a Python-based DDoS tool (MHDDoS) from an attacker-controlled server, disables TLS verification during download, and exfiltrates host reconnaissance data to a hardcoded endpoint. The package masquerades as a utility helper for n8n community nodes but performs no legitimate function.