package: use secure-random 1.1.1