In 3.0.0, the method of obtaining the crypto module in Node.js has changed, so that's likely what's causing the issue.

For a bit of background: Since 3.0.0, when bcrypt.js is imported as an ECMAScript module, there's now a normal import crypto from "crypto", whereas when it is imported as a CommonJS module, there's a require("crypto"). In Node.js 23+, Web Crypto API has become available globally, so that'll be used, but that condition doesn't apply here.

There are a bunch of tests to assert that these mechanism are working when the library is consumed, but perhaps your application utilizes another method of consuming the library. Is the build trying to bundle it perhaps? Asking because if that's the case, it might be that the bundler is consuming the ECMAScript module now, potentially omitting the crypto import. Just a guess ofc. Could you provide more details on how the library is used?

Might have spotted the issue, let me know if 3.0.2 fixes the problem for you!