Summary
Togoder Security scanned the npm package json-rpc-engine@6.1.0 on Oct 4, 2026. An AI review of 8 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Third-party dependency import
NPS-F0561A46468F
The module imports from './getUniqueId', which is outside this file. The behavior of createIdRemapMiddleware depends on the safety of that internal module, which is not provided for review. If getUniqueId were compromised (e.g., side effects or network calls), this middleware would inherit that risk.
Source map exposure
NPS-5D325F6ECC9B
The file includes an embedded base64-encoded source map (data:application/json;base64,...) that exposes the original TypeScript source code. This is not malicious, but it reveals internal source structure that a published package may not intend to expose.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/idRemapMiddleware.js | medium | No malicious patterns detected; the code is a benign Express-style middleware that remaps request IDs and embeds a source map, with only minor informational concerns noted. |
| dist/JsonRpcEngine.js | safe | No malicious patterns detected |
| dist/asMiddleware.js | safe | No malicious patterns detected; the code is a straightforward Express-style middleware adapter with no external calls, obfuscation, or dangerous operations. |
| dist/createAsyncMiddleware.js | safe | No malicious patterns detected |
| dist/createScaffoldMiddleware.js | safe | No malicious patterns detected; the file is a benign middleware factory with no network, filesystem, process, or dynamic code execution behavior. |
| dist/getUniqueId.js | safe | The file contains a simple unique ID generator with no suspicious network, filesystem, process, or obfuscated behavior. |
| dist/index.js | safe | No malicious patterns detected; the file only contains standard TypeScript re-export boilerplate and a source map. |
| dist/mergeMiddleware.js | safe | No malicious patterns detected; the code merely composes middleware into a JsonRpcEngine and contains no network, filesystem, process, obfuscation, or credential-harvesting behavior. |
Frequently asked questions
Is json-rpc-engine safe to use?
No confirmed malware was found in json-rpc-engine@6.1.0, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does json-rpc-engine contain malware?
No malware was identified in json-rpc-engine@6.1.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was json-rpc-engine checked?
Togoder Security downloaded the published npm package and had an AI model read its 8 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan json-rpc-engine together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in json-rpc-engine@6.1.0, cost nothing.