fix: Deprecate the url: import feature

docs/guide/essentials/remote-code.md

@@ -1,5 +1,9 @@
 # Remote Code
 
+:::warning Deprecated
+This feature is susceptible to supply-chain attacks and will be removed in the next major version of WXT. See [issue #2262](https://github.com/wxt-dev/wxt/issues/2262) for more details.
+:::
+
 WXT will automatically download and bundle imports with the `url:` prefix so the extension does not depend on remote code, [a requirement from Google for MV3](https://developer.chrome.com/docs/extensions/migrating/improve-security/#remove-remote-code).
 
 ## Google Analytics

packages/wxt/src/core/builders/vite/plugins/download.ts

@@ -1,12 +1,16 @@
 import type { Plugin } from 'vite';
 import type { ResolvedConfig } from '../../../../types';
 import { fetchCached } from '../../../utils/network';
+import consola from 'consola';
 
 /**
  * Downloads any URL imports, like Google Analytics, into virtual modules so
  * they are bundled with the extension instead of depending on remote code at
  * runtime.
  *
+ * @deprecated This feature is susceptible to supply-chain attacks and will be
+ *   removed in the next major version of WXT. See
+ *   https://github.com/wxt-dev/wxt/issues/2262 for more details.'
  * @example
  *   import 'url:https://google-tagmanager.com/gtag?id=XYZ';
  */
@@ -29,6 +33,9 @@ export function download(config: ResolvedConfig): Plugin {
       },
       handler(id) {
         const url = id.replace('\0url:', '');
+        consola.warn(
+          `Deprecated: This feature is susceptible to supply-chain attacks and will be removed in the next major version of WXT. See https://github.com/wxt-dev/wxt/issues/2262 for more details.`,
+        );
         return fetchCached(url, config);
       },
     },