The @depup/memfs npm package is a malicious republish of the legitimate memfs package. It replaces the original source code with requires to attacker-controlled packages under the @jsonjoy.com namespace, causing installation or import to execute malicious code from these dependencies. This repackaging effectively creates a dependency-chain dropper that runs attacker-published code without lifecycle hooks. The affected version is exactly 4.67.0-depup.0.