The npm package @years18/n8n-nodes-utils-helper-p version 1.0.0 contains malicious code that executes during installation. Its postinstall script disables TLS verification to download and extract malicious tarballs containing Python-based DDoS attack tools. It installs network-attack dependencies and runs a Python script that turns the host into a DDoS attack node. Additionally, it collects system identifiers and installation progress, encodes this data, and sends it to a remote server without secure verification. The package's shipped node file is misleadingly named, contradicting its stated benign purpose.