Run npm audit on a modern frontend project, and there is a high chance you will see dozens of vulnerabilities across a node_modules folder weighing 400MB—all for an application that essentially adds numbers, calculates dates, or formats text.
When building Urban Mixo, a suite of 30 computational utilities and developer tools, we made an intentional architectural constraint: Zero runtime dependencies. Zero npm packages. 100% client-side vanilla JavaScript.
The result? A site with sub-second paint times, a 100/100 Google Lighthouse score, and zero security supply-chain risks.
Here are the 6 modern native Web APIs that allowed us to replace popular npm packages without sacrificing a single feature.
1. Web Crypto API vs. uuid / crypto-js
Most developers reach for npm packages like uuid, nanoid, or crypto-js whenever they need cryptographic randomness or unique identifiers.
The problem with JavaScript's default Math.random() is that it uses a deterministic pseudo-random number generator (PRNG) like xorshift128+. It is predictable and suffers from modulo bias.
The Native Replacement: window.crypto.getRandomValues
Modern browsers have a hardware-backed Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) built right into the global object.
Here is how we built our CSPRNG Password Generator without a single package:
javascript // Unbiased cryptographic random integer between min and max using rejection sampling function getCSPRNGInt(min, max) { const range = max - min + 1; const maxSafe = Math.floor(4294967296 / range) * range; const buffer = new Uint32Array(1); let randomVal; do { window.crypto.getRandomValues(buffer); randomVal = buffer[0]; } while (randomVal >= maxSafe); // Eliminates modulo bias return min + (randomVal % range); } 
