The npm package @years17/n8n-nodes-utils-helper-d version 1.0.0 contains malicious code that executes during installation and when required. It collects sensitive host information including directory listings, internal DNS names, and SSH authorized keys, encodes this data, and sends it to a remote server with TLS verification disabled. The package also supports remote command execution by receiving commands via a parameter and writing their output to a temporary file. This behavior indicates an active reconnaissance and credential theft campaign targeting installer environments.