The npm package @years18/n8n-nodes-utils-helper-s version 1.0.0 contains malicious code in its postinstall script. This script downloads two tarballs from an unrelated domain with TLS verification disabled, installs Python dependencies unsafely, and executes a Python script. It also collects system information and sends it encoded to a remote server. The package mimics legitimate n8n community node packages but its functional code is a stub, with the malicious activity occurring during installation.