The npm package '@years19/n8n-nodes-utils-helper-d' version 1.0.0 is a malicious package masquerading as a community node for the n8n workflow automation tool. Its postinstall script downloads and installs a malicious Python package that shadows a legitimate module, enabling execution of attacker-supplied code. It also collects system information and sends it to an attacker-controlled server. The package contains no legitimate functionality and acts as a dropper for offensive tools consistent with DDoS activity.