Cryptographically secure number generator for node.js

You are correct that Math.random() is not secure. If you want a CSPRNG in Node.js, crypto.randomBytes() is what you're looking for.

There are a few libs available, but I need to be certain whether they are really true random.

Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin.

Basically, no library can generate any "really true random"s. Lately some processors include support for hardware RNGs, which allows (hopefully) "really true random"s to be generated.

That being said, there are -very- few applications for which a CSPRNG will not suffice. In fact, CSPRNGs offer such good quality randomness that I can't think of any.