The npm package @years19/n8n-nodes-utils-helper-j version 1.0.0 contains malicious code that activates during installation or import. It downloads multiple tarballs from an attacker-controlled server with disabled TLS verification, extracts them, and launches Python processes to conduct a DDoS attack against a hardcoded IP address. Additionally, it collects system information and attack logs, encoding and sending them to the attacker. This behavior effectively turns the host into a bot for DDoS attacks and leaks host identity information.