The npm package @years19/n8n-nodes-utils-helper-k version 1.0.0 contains malicious code that executes during installation and import. It downloads multiple attacker-hosted tarballs containing DDoS tools, disables TLS verification during downloads, and executes a Python script to launch UDP/TCP/GET flood attacks against a specific IP address. Additionally, it collects and exfiltrates system identifiers to a command-and-control server. The package masquerades as a utility helper for n8n but provides no legitimate functionality.