The npm package @years20/n8n-nodes-utils-helper-b version 1.0.0 contains malicious code that executes during installation and runtime. It collects system information and SSH public key data, encodes it, and exfiltrates it to a remote server with TLS verification disabled. Additionally, it writes a private SSH key to a temporary file and attempts to SSH into localhost on specific ports to find pre-provisioned access on developer and CI hosts. This behavior enables persistent command and control capabilities and potential lateral movement within affected environments.