The npm package @years17/n8n-nodes-utils-helper-g version 1.0.0 contains malicious code that runs a postinstall script to append an attacker-controlled SSH public key to the installer's authorized_keys file, enabling persistent remote SSH access. It also collects host system information and exfiltrates it to a remote server with disabled certificate verification. Additionally, it exposes a node that executes system commands and returns their output, providing a post-exploitation capability within n8n workflows.