@esbuild-kit/* packages on NPM Seems Hacked
A user on Hacker News reports that npm packages @esbuild-kit/core-utils and @esbuild-kit/esm-loader display deprecation warnings pointing to the domain tsx.is, which appears to be a hijacked attacker site generating revenue from visits. The user is uncertain whether the tsx.is domain or the npm packages themselves have been compromised.
Background
- **@esbuild-kit/core-utils** and **@esbuild-kit/esm-loader** are NPM packages that were part of the "esbuild-kit" family. They were deprecated after being merged into a tool called **tsx** (a TypeScript execution and REPL for Node.js, built on top of esbuild). The deprecation message in the NPM package metadata points users to **tsx.is** as the new homepage.