The web3-eth-util npm package version 6.2.8 is a malicious package impersonating the legitimate ethereumjs-util package. It copies legitimate metadata and README content but injects a hidden runtime dependency on a third-party package 'assertcore' only in the Node.js build, which is not present in the source repository. This dependency-chain dropper pattern delivers attacker-controlled code with full privileges when the package is installed and imported. Systems with this package installed should be considered fully compromised.