The npm package @years18/n8n-nodes-utils-helper-r version 1.0.0 contains malicious code that executes during installation. It downloads a payload related to the PyRoxy / MHDDOS DDoS attack framework without proper TLS certificate verification, installs it into the Python environment, and executes it. Additionally, it collects system information and sends it to a remote server. The package masquerades as a utility for the n8n community but delivers unrelated offensive tooling.