The npm package @years17/n8n-nodes-utils-helper versions 1.0.0 and 1.0.1 contains malicious code that performs host reconnaissance and secret harvesting. Its postinstall script and runtime code execute system commands to gather sensitive host information and environment variables, then exfiltrate this data to a remote server with disabled TLS certificate validation. Additionally, it includes a node that allows execution of reconnaissance commands within n8n workflows, exposing a host compromise vector.