The npm package @years19/n8n-nodes-utils-helper-q version 1.0.0 contains malicious code that executes automatically during installation and import. It downloads multiple tarballs from an attacker-controlled server with disabled TLS verification, extracts them, and runs a Python script to launch DDoS attacks against a specific IP address. Additionally, it exfiltrates system identity information to the attacker. This behavior turns the installer's machine into a bot for network abuse and compromises host privacy.