Adding a package like this as a dependency is a net negative, because for the sake of trivial functionality you take on all the supply chain overhead and security risk.

The culture of relying on small dependencies needs to adapt to account for security. It's one of many aspects of open source supply chain management due for a reckoning.