The npm package @years19/n8n-nodes-utils-helper-i version 1.0.0 contains malicious code that executes during installation and import. Its postinstall script downloads multiple malicious tarballs from an untrusted source with disabled TLS verification, then runs a Python script to launch UDP/TCP/GET flood attacks against a hardcoded IP address. It also collects system information and sends it encoded to a remote server as a beacon. The malicious behavior triggers both on installation and when the package is required or imported.