Vet a New Dependency Before You Add It

Act as a senior engineer responsible for supply-chain hygiene. I want to add a third-party package. Help me decide whether it's worth the risk and cost, using evidence I gather, not your memory of the package.

Package name and the version I'd install: {{PACKAGE}}
What I need it for: {{NEED}}
Information I gathered (repository page, release history, open issues, license, download stats, maintainers, dependency tree output): {{GATHERED_INFO}}

Do this:
1. Could the need be met with the standard library or a dependency we already have? Show roughly how much code that would be.
2. Assess from my info: maintenance activity, number of maintainers, release cadence, open security advisories, license compatibility with commercial use, and size of its transitive dependency tree.
3. Red flags: a recently changed maintainer, install scripts, a name that's one character away from a popular package, very new package with sudden popularity, or abandoned repository.
4. A verdict: Adopt / Adopt with pinning and monitoring / Avoid, with reasons.
5. If adopting: how to pin it, which automated audit to run, and how to wrap it so it's easy to replace.

If my gathered info doesn't cover a point, say "Not provided" and tell me where to look. Don't rely on what you remember about this package; it may be out of date.