The npm package web3-eth-utils version 6.2.8 is a malicious package impersonating the legitimate ethereumjs-util library. It contains injected code that requires a malicious dependency 'assertcore', which executes arbitrary code at install or require time. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate the compromise due to potential persistent malicious code.