The npm package @years19/n8n-nodes-utils-helper-b version 1.0.0 is a malicious package masquerading as a utility helper for n8n workflow automation. It contains a minimal stub node with no real functionality, serving as a cover for malicious behavior. During installation, it executes a postinstall hook that collects system information (user ID and hostname), downloads a malicious tarball from an external URL with TLS verification disabled, and extracts it into the Python site-packages directory. This allows remote code execution on subsequent Python imports. The package also probes the host for offensive security tools and exfiltrates collected data encoded in base64 to a remote server. This behavior enables attackers to gain persistent code execution and gather reconnaissance data from infected systems.