The npm package @years18/n8n-nodes-utils-helper-y version 1.0.0 contains malicious code executed during installation. Its postinstall script downloads and runs offensive Python toolkits (mhddos, PyRoxy, impacket) with TLS verification disabled, compromising the host. It also collects system information and sends it to an attacker-controlled server. This results in automatic execution of attacker-controlled code and persistent implantation of malicious Python modules.