The npm package 'eth-util' is a malicious impersonation of the legitimate '@ethereumjs/util' package. It copies the README, repository URL, badges, contributor list, and API from the legitimate project but injects a hidden dependency 'assert-kit' in the compiled code that executes arbitrary code when required. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.