You Probably Don't Need That npm Package: 6 Native Web APIs That Made Our Tools 100% Dependency-Free

Run npm audit on a modern frontend project, and there is a high chance you will see dozens of vulnerabilities across a node_modules folder weighing 400MB—all for an application that essentially adds numbers, calculates dates, or formats text.

When building Urban Mixo, a suite of 30 computational utilities and developer tools, we made an intentional architectural constraint: Zero runtime dependencies. Zero npm packages. 100% client-side vanilla JavaScript.

The result? A site with sub-second paint times, a 100/100 Google Lighthouse score, and zero security supply-chain risks.

Here are the 6 modern native Web APIs that allowed us to replace popular npm packages without sacrificing a single feature.

---

1. Web Crypto API vs. uuid / crypto-js

Most developers reach for npm packages like uuid, nanoid, or crypto-js whenever they need cryptographic randomness or unique identifiers.

The problem with JavaScript's default Math.random() is that it uses a deterministic pseudo-random number generator (PRNG) like xorshift128+. It is predictable and suffers from modulo bias.

The Native Replacement: window.crypto.getRandomValues

Modern browsers have a hardware-backed Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) built right into the global object.

Here is how we built our CSPRNG Password Generator without a single package:

javascript
// Unbiased cryptographic random integer between min and max using rejection sampling
function getCSPRNGInt(min, max) {
  const range = max - min + 1;
  const maxSafe = Math.floor(4294967296 / range) * range;
  const buffer = new Uint32Array(1);
  let randomVal;

  do {
    window.crypto.getRandomValues(buffer);
    randomVal = buffer[0];
  } while (randomVal >= maxSafe); // Eliminates modulo bias

  return min + (randomVal % range);
}