The npm package @years19/n8n-nodes-utils-helper-h version 1.0.0 contains malicious code that executes during installation. It downloads multiple Python payloads without proper TLS certificate validation, extracts them, and launches a background Python script that performs distributed denial-of-service (DDoS) attacks against a hardcoded IP address. The script also collects host system information and sends it to a remote server with disabled TLS verification.