i did mention "and while pure js alternatives are available, they run terribly"

Slow is much faster than it not working at all. If this is a project that you might not touch for months or years, perhaps having fast bcrypt is not that important.