disclaimer: I haven't seen the code

TS/JS is not the problem.

You can, and you should eject your dependencies and package them with your releases. And I don't understand why it's not a common practice.

You can even bundle your releases with a runtime, but that's not always the best solution. For something like this I'd actually prefer interpreted code I can inspect line by line rather than having a blob of unknown origin.