# @metamask/json-rpc-engine@7.3.3 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-04T16:06:48.000Z
- Files reviewed: 7
- Findings: no findings
- Report: https://security.togoder.click/npm/@metamask/json-rpc-engine@7.3.3
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @metamask/json-rpc-engine@7.3.3 on Oct 4, 2026. An AI review of 7 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `dist/JsonRpcEngine.js` (safe): No malicious patterns detected; the code is a standard JSON-RPC engine implementation from MetaMask with no suspicious behavior.
- `dist/createAsyncMiddleware.js` (safe): No malicious patterns detected; the code is a standard async middleware wrapper with no network, filesystem, process, or obfuscation activity.
- `dist/createScaffoldMiddleware.js` (safe): No malicious patterns detected
- `dist/getUniqueId.js` (safe): No malicious patterns detected; the code is a simple unique ID generator with no network, filesystem, process, or obfuscation concerns.
- `dist/idRemapMiddleware.js` (safe): No malicious patterns detected
- `dist/index.js` (safe): No malicious patterns detected; this is a standard TypeScript-compiled barrel file re-exporting local middleware modules.
- `dist/mergeMiddleware.js` (safe): No malicious patterns detected in mergeMiddleware.js; it simply composes a middleware stack using a local JsonRpcEngine module.

## Version ranges

None of the 2 scanned versions of @metamask/json-rpc-engine are flagged high or critical. The latest scanned version, 11.0.0, is not scanned. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 9.0.3 – 11.0.0 (`>=9.0.3 <=11.0.0`): not scanned
- 7.3.3 – 8.0.2 (`>=7.3.3 <=8.0.2`): clean

## Scanned versions

- [8.0.2](https://security.togoder.click/npm/@metamask/json-rpc-engine@8.0.2): safe, 2026-10-04T16:07:15.000Z
- [7.3.3](https://security.togoder.click/npm/@metamask/json-rpc-engine@7.3.3): safe, 2026-10-04T16:06:48.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology