Yes, they are. And a pain in the ass when a dev can't get the package syntax right to import cjs when appropriate, but claim to support both targets. I literally patch hcaptcha locally to be able to build with it.