The npm package @years19/n8n-nodes-utils-helper-g version 1.0.0 contains malicious code embedded in its postinstall script and main entrypoint. This code downloads multiple offensive network-attack tools from an external server with TLS verification disabled, extracts them, and executes a Python script on the host machine. It also collects system information and execution results, encoding and sending them to a remote server. This behavior occurs automatically during installation and module usage.