The npm package @years19/n8n-nodes-utils-helper-y version 1.0.0 contains malicious code that executes during installation and runtime. It writes and launches a Python script that floods a remote IP with network traffic and exfiltrates host identity data to a remote server with disabled TLS verification. This behavior occurs both on npm install and when the package is required or loaded by n8n.