Arbitrary file read via post-validation path remapping

Path traversal in esm.sh 137 and earlier allows remote attackers to read arbitrary server files through a malicious npm package. The esbuild plugin's OnResolve callback checks the original module path, then applies an attacker-controlled browser-field remapping with ../ segments without revalidating the resulting path. Exploitation requires publishing a package and requesting its build; returned files can include configuration data containing registry or storage credentials.