# json-rpc-engine@6.1.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:33:53.000Z
- Files reviewed: 8
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/json-rpc-engine
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package json-rpc-engine@6.1.0 on Oct 4, 2026. An AI review of 8 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Third-party dependency import

Finding ID: `NPS-F0561A46468F`

File: `dist/idRemapMiddleware.js:3`

The module imports from './getUniqueId', which is outside this file. The behavior of createIdRemapMiddleware depends on the safety of that internal module, which is not provided for review. If getUniqueId were compromised (e.g., side effects or network calls), this middleware would inherit that risk.

### [low] Source map exposure

Finding ID: `NPS-5D325F6ECC9B`

File: `dist/idRemapMiddleware.js:20`

The file includes an embedded base64-encoded source map (data:application/json;base64,...) that exposes the original TypeScript source code. This is not malicious, but it reveals internal source structure that a published package may not intend to expose.

## Files reviewed

- `dist/idRemapMiddleware.js` (medium): No malicious patterns detected; the code is a benign Express-style middleware that remaps request IDs and embeds a source map, with only minor informational concerns noted.
- `dist/JsonRpcEngine.js` (safe): No malicious patterns detected
- `dist/asMiddleware.js` (safe): No malicious patterns detected; the code is a straightforward Express-style middleware adapter with no external calls, obfuscation, or dangerous operations.
- `dist/createAsyncMiddleware.js` (safe): No malicious patterns detected
- `dist/createScaffoldMiddleware.js` (safe): No malicious patterns detected; the file is a benign middleware factory with no network, filesystem, process, or dynamic code execution behavior.
- `dist/getUniqueId.js` (safe): The file contains a simple unique ID generator with no suspicious network, filesystem, process, or obfuscated behavior.
- `dist/index.js` (safe): No malicious patterns detected; the file only contains standard TypeScript re-export boilerplate and a source map.
- `dist/mergeMiddleware.js` (safe): No malicious patterns detected; the code merely composes middleware into a JsonRpcEngine and contains no network, filesystem, process, obfuscation, or credential-harvesting behavior.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology