The npm package @years19/n8n-nodes-utils-helper-v version 1.0.0 contains malicious code that executes during installation and import. It writes and launches a Python script that performs a UDP/TCP flood DDoS attack against a specific IP address for 600 seconds. Additionally, it collects system information, encodes it, and sends it to a hardcoded external server, leaking host identity.