Calling require() on an ES module was behind --experimental-require-module in Node 22.0 through 22.11. It is on by default from Node 22.12.0, and the same support was backported to Node 20.19.0. This means a CommonJS package can require() an ESM-only dependency without a dynamic import() wrapper, as long as the target graph is fully synchronous.
The important caveat is top-level await. If the required module, or anything it imports, uses top-level await, the require call throws ERR_REQUIRE_ASYNC_MODULE. There is no fallback: the module must be loaded with dynamic import() instead. require() of an ESM module returns the module namespace object, so a default export is reached as .default, not as the return value itself.
Confirm the runtime behavior with node -e "console.log(require('./mod.mjs'))" on the version you ship. Library authors should not assume this works for consumers on Node 18 or on Node 20 before 20.19, which are still common in CI images.