The npm package @years18/n8n-nodes-utils-helper-l version 1.0.0 contains malicious code that executes on installation and when required. It downloads and runs a Python-based DDoS toolkit from an untrusted external source with TLS validation disabled, collects host system information, and exfiltrates it to a remote server. This behavior occurs automatically due to the package's main module loading on require, including when used by the n8n runtime for community nodes.