I wrote a checklist with some questions that can help you find potential issues with third party packages:
- [ ] Is the package licensed in a way you can use?
- [ ] Is the package's latest published version free of known security vulnerabilities? (can check with https://snyk.io/vuln/npm:moment)
- [ ] Is the package tested? (there need to be at least some unit tests)
- [ ] Is the package lightweight? (can check with https://bundlephobia.com/, this should be considered alongside the size of the problem being solved)
- [ ] Is the package dependant on no other packages? (0 dependencies = less to worry about)
- [ ] Is the package maintained? (activity in the last year, don't forget to check branches other than master)
- [ ] Is the package popular and widely used? (depended on by lots of other projects, number of stars on GitHub)
- [ ] Is the package well structured and easy to understand? (could you contribute and make changes to it quickly? you may have to!)
Once you do decide to adopt something, it's a good pattern to only import it in one place (like an internal `helper` library) and to reference that in every part of the codebase where it's needed. This is in case you decide to replace it in the future, so you only have to change one place.