Math.random() is not cryptographically secure and should not be used for security-sensitive operations.
Use crypto.getRandomValues() or crypto.randomBytes() for security-sensitive randomness.