The npm package @years20/n8n-nodes-utils-helper-a version 1.0.0 contains malicious code that executes during installation and module import. It collects system identifiers and SSH host key fingerprints, sending them to a hardcoded external server. The package also deploys an embedded private SSH key locally and attempts to SSH into local accounts, reporting successful logins back to the attacker. Additionally, it establishes a server-side command channel via a remote PHP handler, enabling execution of arbitrary commands.