Dual ESM/CJS format or clear ESM-only stance

A CJS-only package blocks ESM consumers entirely — they cannot use static import syntax and must resort to dynamic import() or createRequire workarounds. ESM-only packages break all CommonJS consumers (many Node.js scripts, Jest without experimental VM modules, older tools). ISO 25010 interoperability requires supporting both resolution systems until the ecosystem fully migrates. SSDF PS.3.2 flags format mismatches as a distribution integrity concern: the format published must match what consumers expect given the type field and exports conditions.

Configure your build tool to emit both ESM and CJS outputs and map them in package.json exports.

// tsup.config.ts — dual format output:
import { defineConfig } from 'tsup'
export default defineConfig({
  entry: ['src/index.ts'],
  format: ['esm', 'cjs'],
  dts: true,
  splitting: false,
  clean: true
})

{
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
      "import": "./dist/index.js",
      "require": "./dist/index.cjs"
    }
  },
  "type": "module"
}

If you commit to ESM-only, set "type": "module" and document the minimum Node.js version (18+) in the engines field and README.