The npm package @years19/n8n-nodes-utils-helper-s version 1.0.0 contains malicious code that executes during installation and module import. It writes and launches a Python script that performs a UDP/TCP flood attack against a hardcoded IP address for 600 seconds. Additionally, it collects host system information, encodes it, and exfiltrates it to a remote server with disabled TLS verification. The package masquerades as a utility node for n8n but has no legitimate functionality, instead using the host as a bot for DDoS attacks and reconnaissance.