The npm package @years17/n8n-nodes-utils-helper-e version 1.0.0 contains malicious code that establishes a persistent SSH backdoor on the host by appending an attacker-controlled SSH public key to the authorized_keys file. It also performs system reconnaissance commands and exfiltrates the collected data to a remote server with disabled TLS validation. Additionally, it registers a node that executes system commands and returns their output with a marker indicating compromise.