Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.
They have international agreements with a number of countries for surveillance.
This means that unless an app is completely hosted, in all parts from source code to production, in a privacy-friendly country, on servers provided by a privacy-friendly company and the app is made by a company in similar conditions, the US and EU have all they need.
Chinese companies absolutely do not have this track record. Chinese companies are essentially an extension of the heavy hand of the Chinese Communist Party.