eth-library-toolkit @2.1.3

Summary

eth-library-toolkit@2.1.3 presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo — but is published under an unaffiliated npm account (azeura <azeura@gmail.com>). The package's dist/index.js unconditionally executes require("commonjs-assertion") at load time, and package.json declares "commonjs-assertion": "^1.2.7" as a runtime dependency in place of the upstream ethjs-util dependency used by the real @ethereumjs/util. commonjs-assertion is not an ethereumjs project and has no functional relationship to the utility APIs this package advertises. Any consumer that installs and requires eth-library-toolkit will resolve and execute whatever code commonjs-assertion currently ships, giving the substituted package arbitrary code execution inside the installer's Node.js process. The impersonation shell plus forced third-party dependency load matches the lookalike-clone-as-delivery-vehicle supply-chain pattern.

Source: amazon-inspector (70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff)