Malicious code in @depup/memfs (npm)
@depup/memfs is a malicious republish of the legitimate memfs package that strips upstream source code and injects nine attacker-controlled @jsonjoy.com/fs-* dependencies. Installing the package automatically executes code from these injected dependencies without requiring lifecycle hooks.
- Disclosed
- Last updated
- Blast radius
- Any project that installed @depup/memfs; downstream execution of malicious code from @jsonjoy.com/fs-* packages
- Ecosystems
- Attack vectors
- Affected entities
- @depup/memfsMalicious republish of memfs with stripped source and injected dependencies
- @jsonjoy.com/fs-node · 4.67.0
- @jsonjoy.com/fs-core · 4.67.0
- @jsonjoy.com/fs-node-utils · 4.67.0
- @jsonjoy.com/fs-fsa · 4.67.0
- @jsonjoy.com/fs-node-to-fsa · 4.67.0
- @jsonjoy.com/fs-fsa-to-node · 4.67.0
- @jsonjoy.com/fs-print · 4.67.0
- @jsonjoy.com/fs-snapshot · 4.67.0
- @jsonjoy.com/fs-node-builtins · 4.67.0
@depup/memfs is a malicious republish of the legitimate memfs package distributed on npm. The attacker stripped the original lib/index.js and lib/index.d.ts files and replaced them with code that only contains require() calls to nine newly-introduced @jsonjoy.com/fs-* packages (fs-node, fs-core, fs-node-utils, fs-fsa, fs-node-to-fsa, fs-fsa-to-node, fs-print, fs-snapshot, fs-node-builtins), all pinned to version 4.67.0.
The legitimate upstream memfs package bundles its own source code and does not depend on any of these @jsonjoy.com packages. The version 4.67.0 tag used for these injected dependencies does not correspond to any real release history of those libraries, indicating they were created specifically for this attack.
The package.json metadata also records suspicious version bumps for @jsonjoy.com/json-pack and @jsonjoy.com/util from ^1.11.0/^1.9.0 to ^18.28.0, non-contiguous jumps well beyond the real published range of those libraries. This pattern is consistent with steering the npm resolver toward attacker-published versions.
Installing or requiring @depup/memfs automatically pulls in and executes code from the attacker-controlled @jsonjoy.com/fs-* packages without requiring any lifecycle hooks, making this a dependency-chain dropper attack via a memfs lookalike.
Indicators of compromise
- Packages
- @depup/memfs
- @jsonjoy.com/fs-node@4.67.0
- @jsonjoy.com/fs-core@4.67.0
- @jsonjoy.com/fs-node-utils@4.67.0
- @jsonjoy.com/fs-fsa@4.67.0
- @jsonjoy.com/fs-node-to-fsa@4.67.0
- @jsonjoy.com/fs-fsa-to-node@4.67.0
- @jsonjoy.com/fs-print@4.67.0
- @jsonjoy.com/fs-snapshot@4.67.0
- @jsonjoy.com/fs-node-builtins@4.67.0
Remediation
- Remove @depup/memfs from all package.json files and lock files immediately
- Audit all projects that may have installed @depup/memfs for signs of compromise
- Use the legitimate memfs package instead of @depup/memfs
- Review npm audit logs and dependency trees for any installation of @depup/memfs or the @jsonjoy.com/fs-* packages at version 4.67.0
- Consider rotating credentials and secrets if they were accessible to code running in affected environments
- Monitor for any suspicious activity or data exfiltration from systems where @depup/memfs was installed
Sources
- GitHub Advisory GHSA-6m4q-wxhf-p7rw · GitHub Advisory Database
Cite this entry
"Malicious code in @depup/memfs (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-depup-memfs-npm-1nt2zl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package