The npm package @years19/n8n-nodes-utils-helper-p version 1.0.0 contains malicious code that executes during installation and runtime. It downloads multiple tarballs from a remote server with disabled TLS verification, extracts them, and launches Python processes to perform a network attack against a hardcoded target. The package also collects system information and attack status, encoding and sending this data to a remote server, which can issue shell commands back to the infected system, establishing a command and control channel.