This is a major breaking change that I didn't notice until today when I picked up the latest patch version in a transitive dependency. Because the type in the package.json is module, all .js files are treated as ESM (even though in this case they are not). The easiest solution here is to actually emit a .cjs file in dist instead and update the corresponding exports. This is a major blocker for me because currently anyone using require on the module will break (only ESM imports work at the moment).