Math.random() is not cryptogaphically secure, but the crypto-random-string package provides what is needed with a cryptographically secure pseudo-random number generator.
