The npm package @years18/n8n-nodes-utils-helper-m version 1.0.0 contains malicious code that executes during installation and when required. It downloads and runs a DDoS tool (mhddos / PyRoxy) with disabled TLS verification, collects system information and command output, encodes this data, and sends it to a remote server. The package masquerades as a helper for n8n community nodes but performs no legitimate functionality.