Where does the entropy of BitcoinJS' makeRandom() come from?
This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as one's browser was not hacked.