The npm package @years18/n8n-nodes-utils-helper-k version 1.0.0 contains malicious code that executes during installation and import. It downloads and runs a Python-based DDoS toolkit called MHDDoS, disables HTTPS certificate verification during download, and exfiltrates host system information encoded in base64 to a remote server. This compromise occurs regardless of whether npm lifecycle scripts are enabled, affecting all users who install or import the package.