The ESM-only packages like node-fetch are such a pain to work with in Node in a CommonJs project. I think this forced ESM is causing a lot vulnerabilities in c

The ESM-only packages like node-fetch are such a pain to work with in Node in a CommonJs project. I think this forced ESM is causing a lot vulnerabilities in code base due to the pain converting projects to ESM is. I am busy enough to try to get tests pass for some new version of a package that got ESM-only. Wished they would publish cjs and esm for packages that target Node. Fine you go ESM-only for browser only packages.