The npm package @years17/n8n-nodes-utils-helper-h version 1.0.0 contains malicious code that executes a postinstall script performing host reconnaissance and establishes persistent unauthorized SSH access by appending an attacker-controlled public key to the authorized_keys file. It exfiltrates collected system information over an insecure HTTPS request with disabled TLS verification. Additionally, it exposes a method allowing runtime execution of shell commands, effectively providing a remote shell execution capability within workflows. This package masquerades as a utility helper for n8n but is designed for host takeover.