The 'eth-util' package on npm impersonates the legitimate '@ethereumjs/util' by copying its public-facing metadata and API. However, the published npm tarball includes a post-compile injected require statement for 'assert-kit', a dependency not present in the source code. This dependency allows execution of arbitrary top-level code upon requiring 'eth-util'. The 'assert-kit' package is named to mimic Node's built-in 'assert' module and is declared with a caret version range (^4.3.2), enabling the attacker to deliver arbitrary code in future minor or patch updates. This behavior effectively compromises any system that installs or runs 'eth-util'.

Any system with 'eth-util' version 7.1.5 installed or running is considered fully compromised. The malicious code can execute arbitrary commands with the privileges of the user running the package. This compromises all secrets and keys stored on the system, necessitating immediate rotation from a separate, trusted environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Remove the 'eth-util' package version 7.1.5 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised systems from a secure, uncompromised environment. Monitor for any signs of persistent compromise or additional malicious software. There is no official patch or fix since this is a malicious package impersonation; prevention involves avoiding installation of this package and verifying package authenticity before use.