The npm package @years19/n8n-nodes-utils-helper-e version 1.0.0 contains malicious code that masquerades as an n8n community utility node. Its postinstall script collects host identity information, downloads and extracts a malicious Python package with disabled TLS verification, stages offensive Python libraries, and executes a malicious Python script. It exfiltrates collected data encoded in base64 to a remote server. The package publisher is unrelated to the domain hosting the payload.