Using a file as the function_source_type would be the best as I think you might have to copy and paste the whole crypto Js library in the Js middleware/plugin or reference it from the tyk_js_path. A minified version of the library usually helps.
However, a google search of the crypto-js library, shows it’s probably depends on other files which wouldn’t be efficient in this case. I would suggest taking advantage of gRPC Rich Plugins and using NodeJs instead
Just to further clarify. The JS plugins and virtual endpoints wont ever be able to import external libraries in that way. They are just really an ecmascript interpreter on top of Go code. You have what is available in the docs here on GitHub - robertkrimen/otto: A JavaScript interpreter in Go (golang)
To have more wide language functionality you need to make the jump to something like a NodeJS plugin via our gRPC plugins, or select another language.