[email protected] is a malicious npm package that clones the legitimate ethereumjs-util package but injects a side-effect-only require statement for a malicious module 'assertcore' in its compiled Node.js entry point. This require is absent from the source and browser bundles, indicating deliberate code injection after build. When the package is installed or required, it executes arbitrary code from assertcore, granting the attacker install- and require-time code execution on the host system. This compromises the host fully, risking exposure of all stored secrets and keys.

Any system with [email protected] installed or running is fully compromised. The malicious assertcore module executes arbitrary code during package installation or runtime require, potentially allowing attackers full control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the [email protected] package immediately from all systems. Consider all affected systems fully compromised and rotate all secrets and keys from a secure, uncompromised environment. Investigate the system for persistence mechanisms or additional malware beyond the package itself. There is no official patch or fix; the package should be avoided entirely.