not sure where to report this, so I will post it on HN.

I got the following warn from two esbuild packages """ npm warn deprecated @esbuild-kit/[email protected]: Merged into tsx: https://tsx.is npm warn deprecated @esbuild-kit/[email protected]: Merged into tsx: https://tsx.is """

where tsx.is is apparently leads hijacked some attacker site that got paid for each visit. I'm confused if tsx.is domain is hacked, or the package is hacked. Anyone?