The npm package @years19/n8n-nodes-utils-helper-w version 1.0.0 contains malicious code that executes automatically during installation and runtime. It writes and launches a Python script that performs UDP/TCP flooding targeting a hardcoded IP address for 900 seconds. Additionally, it collects system information including the installer's shell ID, hostname, load average, and process listing, encodes this data, and sends it to a remote server with TLS verification disabled. The package masquerades as a utility helper for n8n but contains no legitimate node functionality.