When should I allow npm packages in Claude Code?

I’m using Claude Code web, and it often asks whether I want to allow/use certain npm packages.

I’m trying to build better judgment around when to say yes vs when to avoid adding another dependency.

Are there categories where you usually trust package suggestions, and categories where you usually avoid dependencies?

I’m looking for practical rules of thumb, like: “Use packages for X, but write it yourself for Y.”

Mainly trying to avoid random dependencies that create security risk, break later, bloat the project, or make the code harder to understand.

Any other Claude Code settings, permission, or security tips would also be much appreciated!