The npm package @years18/n8n-nodes-utils-helper-x version 1.0.0 is a malicious package that masquerades as a utility helper for n8n but executes hostile code during installation. It runs a postinstall script that downloads and installs attacker-controlled Python code without TLS verification, allowing arbitrary code execution on the host. The script also collects system information and installation status, sending this data to a remote server, effectively indexing compromised hosts. This behavior is inconsistent with the declared package purpose and indicates a supply chain compromise.