The npm package @years19/n8n-nodes-utils-helper-f version 1.0.0 contains malicious code that executes during installation and when required. It collects host identity and environment information, encodes it, and sends it to an attacker-controlled server with TLS verification disabled. The package masquerades as a legitimate n8n community node but functions as a beacon for attacker command and control.