registry / Malware / cartethyia

cartethyia

A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response

This report shows the evidence for cartethyia@2.3.4. 1 of 16 known versions is blocked or flagged. The newest version, 2.5.4, is allowed. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection confirms automatic, publisher-selected account actions on stored credentials, which the review policy treats as attack behavior. The package has no install lifecycle hook, but the runtime account changes support blocking publication.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Starting the gateway with eligible stored accounts; scheduled tasks and quota refreshes run automatically.

Impact

Changes account growth state and claims credits on the connected accounts.

Mechanism

Scheduled workers select active provider accounts and use their credentials for growth actions when offers are available, without requiring a separate user request for each action.

Attack narrative

On gateway startup, scheduled workers act on stored provider accounts. The adoption worker can accept an agreement and adopt a buddy; routine quota refresh also claims daily credits. These are automatic account actions rather than actions tied to a per-action user request.

AI rationale

Evidence

src/workers/buddy-growth-tasks.tssrc/boot/dependencies.tssrc/workers/daily-checkin.ts

Decision evidence

public snapshot

AI called this Malicious at 87.0% confidence as Malware with low false-positive risk.

Evidence for block

Scheduled growth tasks run against stored active WorkBuddy and CodeBuddy accounts, without a per-action user request.
The adoption task accepts the agreement and adopts a buddy when the upstream reports that the task is available.
The gateway schedules adoption and claims daily credit grants during routine account refreshes.
The daily pass submits the account credential to the provider check-in integration.

Evidence against

The reviewed launcher starts the package CLI; the manifest has no preinstall, install, or postinstall hook.
Growth actions have daily markers and only run when the upstream indicates an offer is available.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

10 flagged

src/providers/discovery/catalog/catalog-blob.tsView file

Lines 1-19typescript

1/**

2 * GENERATED — do not edit.

3 *

4 * The packed, brotli-compressed offline model catalog for `ModelsDevCatalog`.

5 * Rebuild with `bun run scripts/generate/models-catalog.ts`.

6 *

7 * Sources: models.dev (pricing, every provider) and models.opencode.ai (the

8 * authoritative limits for the OpenCode family).

9 *

10 * Fetched 2026-10-17T02:27:15.774Z · 8941 rows · 232 providers ·

11 * 2482 global price keys · 2700 cost tuples ·

12 * 584 KB packed → 105 KB brotli.

13 */

14export const CATALOG_BLOB_BROTLI_BASE64 =

15 "W+8emQdV425rrlcwIcLm0TafQvFcBecKemwnIdXjmFTUCwpv7wx6+ziF6E5SFds5b51i+v//////35dMYs78fbjkB4JVqHVUraNT6RJCIyKiMPSQCWRhgdWia6sxIyjC5nY9TPOGlDl8IFwQLoVokFEew5Vabgt8IhzV1lTb5AS3hDvCZ7zHB3zExC+DkCU48WxycbnyNWXPzKS4BSYDJQWUkbIpby7vJQ1BCl362Ye49KEJESkVnPEeOnCV7ecX0cpu6M7UtKnlBA0t4u+Yep0LlW54rr5ehImqGY+KF7xqbG1+zTADqrZ6ram7/sWiixqpZmLQCKmX1cosoS6LIUIjnmDpYWJ0aStMhAkWxjt0Rq+Lw8TojCc94urwm5CExD/4gA/4iLsS/StEjD/p7eW4+6sMGDJkOMrVlm5CIYl2xP+McTPZvA83rr4ZDHIJAUewWqAbKQxj8qJ9qBXldVQK9QT9w+DQRlEXGQMuwZln3HzQaBErZS6/jVM4wTC9ur9JbjC4OVCi3RwQCIAunD9IYSG2gSdzLJlM7b/ydxWXulR1Vw2yjGcNEk+Aw/p7NausmB3A3qvaqv1xcMILN ...

High

High Secret

Package contains a high-severity secret pattern.

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

High

Secret Pattern

Google API key in src/providers/discovery/catalog/catalog-blob.ts

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

17/** Byte length of the blob *after* decompression, so a reader can preallocate. */

18export const CATALOG_BLOB_BYTES = 597744;

Long lines were clipped for display.

scripts/cli/cli.tsView file

Lines 1-22typescript

1import { randomBytes } from "node:crypto";

2import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

3import { spawn, type ChildProcess } from "node:child_process";

4import { tmpdir } from

dist/dashboard/assets/entry-COuKgXuV.jsView file

Lines 1-4javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/LoginPage-sqFYY4uv.js","assets/jsx-runtime-CXUMngI_.js","assets/toast-DKAdP2mo.js","assets/app-BDJWMThu.js","assets/app-Cjgo4-Lf.css","assets/log-in-BmRjy60c.js","assets/query-keys-ROf-g1Wi.js",

src/providers/integrations/qoder/qoder.tsView file

Lines 11-51typescript

11import { readCredentialSecret, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext } from "../../provider-contracts";

12import type { ModelDefinition } from "../../provider-model-definition";

13import { parseQoderOAuthState } from

scripts/cli/cli-launcher.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const { randomUUID } = require("node:crypto");

scripts/cli/version.tsView file

Lines 21-61typescript

21 try {

22 const response = await fetch("https://registry.npmjs.org/cartethyia/latest", {

23 signal: AbortSignal.timeout(4_000),

24 });

src/boot/dependencies.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/boot/dependencies.ts#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged · loading source

src/providers/discovery/catalog/catalog-blob.tsView file

15patternName = google_api_key severity = high line = 15

High

High Secret

Package contains a high-severity secret pattern.

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

15patternName = google_api_key severity = high line = 15

High

Secret Pattern

Google API key in src/providers/discovery/catalog/catalog-blob.ts

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

scripts/cli/cli.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = cartethyia@2.3.2 matchedIdentity = npm:Y2FydGV0aHlpYQ:2.3.2 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Findings

1 Critical7 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltascripts/cli/cli.ts

HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts

HighChild Processscripts/cli/cli.ts

HighEntrypoint Build Divergencescripts/cli/cli-launcher.cjs

HighSandbox Evasion Gated Capabilityscripts/cli/cli-launcher.cjs

HighRuntime Package Installscripts/cli/version.ts

HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1

HighSecret Patternsrc/providers/discovery/catalog/catalog-blob.ts

MediumDynamic Requiredist/dashboard/assets/entry-COuKgXuV.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to cartethyia@2.3.4.

The versions list below shows the verdict for each recorded version.

Avoid installing cartethyia@2.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-18 04:31:23.988Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

16 known versions

2.5.4latestUnknown—AllowUnder ReviewOct 22, 2026, 1:56 PM 2.5.3Unknown—AllowUnder ReviewOct 21, 2026, 1:57 PM 2.5.1Unknown—AllowUnder ReviewOct 21, 2026, 5:42 AM 2.5.0Unknown—AllowUnder ReviewOct 21, 2026, 5:14 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages