The npm package @years17/n8n-nodes-utils-helper-f version 1.0.0 contains malicious code that executes automatically upon installation and during workflow runs. It performs reconnaissance commands on the host, exfiltrates data via HTTPS to a remote server with disabled TLS verification, and appends an attacker-controlled SSH public key to enable persistent unauthorized access. The package also includes a malicious node that executes system commands and returns a 'pwned' flag, indicating compromise.