The npm package @years19/n8n-nodes-utils-helper-m version 1.0.0 contains malicious code that executes during installation. Its postinstall script downloads multiple Python tools from an attacker-controlled server with disabled TLS verification, installs them, and launches Python processes that perform DDoS attacks against a hardcoded target. It also collects system information and exfiltrates it to the attacker, who can write arbitrary base64-decoded content to the local filesystem. The package name suggests legitimate utility functionality, but no such features exist in the code.