The npm package @years20/n8n-nodes-utils-helper-f version 1.0.0 contains malicious code that executes reconnaissance and data exfiltration payloads both during installation and when required. It collects host identity information, reads the SSH host public key, probes internal network ports, and sends the aggregated data to a remote server with disabled TLS verification. The package masquerades as an n8n helper node but contains no legitimate n8n functionality.