What should you check before adopting an npm package added by AI?

When I asked AI to add a feature, it even added an npm package I didn't know.Looking at the code, it achieves what I wanted ...
CSOonline

Npm ecosystem vulnerable to new manifest confusion attack

Package manifests in the npm registry are not validated against metadata files in the package itself, leaving the door open for attackers. The npm (Node Package Manager) ecosystem of JavaScript ...
InfoWorld

Your npm install was safe. What happens when the package runs?

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...