The npm package @years19/n8n-nodes-utils-helper-a version 1.0.0 contains malicious code executed during its postinstall script. Upon installation, it downloads and extracts a tarball containing attack tools into the Python site-packages directory without proper TLS verification. It then executes commands on the installer's machine, collects system information, and sends this data to a remote attacker-controlled server. This results in unauthorized code execution and data exfiltration on the host system.