When your page loads a script from a CDN or any other third party, you are trusting that server to send the same file tomorrow that it sent today. If the CDN is compromised, or the file is swapped, the attacker's code runs on your site with full access to the page. SRI removes that blind trust.
You add an integrity attribute containing a hash of the exact file you reviewed. The browser downloads the file, computes its hash and compares. If they differ, the file is blocked. For files from another origin you also need the crossorigin attribute, and the other server must send CORS headers, otherwise the check cannot run and the load fails.
SRI only works for files that never change, so link to a specific version rather than a latest address. AI tools commonly paste CDN script tags without an integrity value. Where possible, install the library as a package and bundle it with your app instead, which brings it under your lockfile and removes the third-party request altogether.
<script
src="https://cdn.example.com/lib@1.2.3/lib.min.js"
integrity="sha384-REPLACE_WITH_THE_REAL_HASH"
crossorigin="anonymous"
></script>