The npm package @years18/n8n-nodes-utils-helper-u version 1.0.0 contains malicious code that executes during installation. Its postinstall script runs commands to gather system information, disables TLS certificate validation, and sends data to a remote endpoint. It also installs a Python package and launches a denial-of-service attack tool on the host system, enabling outbound attacks. Additionally, it provides a covert channel for remote command execution via encoded data sent to the attacker-controlled server.