The @depup/memfs package is an automated republish of the memfs library that strips the original source code and replaces it with require calls to nine attacker-controlled packages (@jsonjoy.com/fs-*), all pinned to version 4.67.0, which does not correspond to legitimate releases. This republished package also updates other dependencies to versions far beyond their real published ranges, steering the resolver to attacker-published versions. Installing or importing @depup/memfs results in executing arbitrary code from these malicious dependencies, effectively acting as a dependency-chain dropper without requiring lifecycle hooks.

Users who install or import the @depup/memfs package version 4.67.0-depup.0 will unknowingly execute malicious code from attacker-controlled dependencies. This can lead to arbitrary code execution within the context of the affected environment, potentially compromising system integrity and security.

Avoid using the @depup/memfs package version 4.67.0-depup.0. Instead, use the official memfs package from its legitimate source. Since no official patch or fix is indicated, users should remove this malicious package and audit their dependencies to ensure no other republished or malicious packages are present.