The ethereum-lib-utils package version 1.3.7 impersonates the widely-used ethereumjs-util library by mimicking its metadata and codebase. However, the Node.js build contains a hidden require statement for assertion-utils-js, a dependency that executes malicious payload code upon import. This require statement is absent in the TypeScript source and browser build, indicating deliberate injection in the Node artifact. Systems importing [email protected] transitively execute the malicious assertion-utils-js code, leading to full system compromise. The actual malicious payload resides in the assertion-utils-js dependency rather than in ethereum-lib-utils itself.

Any computer with [email protected] installed or running is considered fully compromised. Attackers may have gained full control over the system, potentially accessing all stored secrets and keys. Simply removing the package does not guarantee removal of all malicious software introduced. Immediate secret and key rotation from a separate, uncompromised system is necessary to mitigate ongoing risk.

Remove [email protected] immediately from all affected systems. Rotate all secrets and cryptographic keys stored on compromised machines from a different, secure computer. Because full system compromise is likely, consider performing a thorough incident response and system rebuild. No official patch or fix is available; avoidance of this malicious package and use of the legitimate ethereumjs-util library is recommended.