As of Apps-Engine v1.28.0 (released in Rocket.Chat v4.0), Rocket.Chat Apps include a subset of NPM packages as dependencies to be used at runtime. While we could not determine the list of all packages that are supported (due to the sheer amount of options available), based on the technical constraints of our implementation, we know that:
Utility packages that are not dependent on NodeJS' native modules should work (for example, lodash, momentjs, etc).
Packages that create any server, be it HTTP, TCP, UDP, or IPC, will not work (for example, express, hapi, etc).
Packages that interact with the fs and os modules will not work.
When using NPM packages in your app, make sure to use the latest rc-apps version (v1.10.1 at the time of this writing) - it is responsible for bundling the code of the packages along with the app's source code.