The npm package @years18/n8n-nodes-utils-helper-w version 1.0.0 is a malicious package masquerading as a helper for n8n workflows. It contains a hostile payload executed during installation and when required, which collects system information, probes for Python packages, installs additional malicious Python modules, and runs a staged DDoS attack tool. The payload sends collected data to a remote server over HTTPS with disabled TLS verification, indicating an attempt to exfiltrate information. This package abuses its declared purpose as a cover for malicious activity.