registry / cartethyia / 2.3.0

cartethyia@2.3.0

A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection found no malicious behavior: the manifest has no install hook, the CLI’s network request is a release-version check, and its update flow requires a tray selection. The scanner’s alleged secret is in a generated compressed offline model catalog; the inspected runtime paths did not establish credential export or an attack surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI runs when invoked; an update runs after a user selects the tray update item.

Impact

No confirmed credential disclosure, unrelated account action, or unconsented installation mutation was found.

Mechanism

The CLI checks Cartethyia’s published npm version and uses npm to update the package after the tray selection.

AI rationale

Evidence

package.jsonscripts/cli/cli.tsscripts/cli/cli-launcher.cjssrc/providers/discovery/catalog/catalog-blob.ts

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest identifies Cartethyia as a self-hosted AI gateway and exposes CLI binaries; it declares no install lifecycle hook.
The CLI’s external version check queries the Cartethyia release on npm. Updating is initiated by selecting the enabled update item in the tray.
The launcher starts the package’s CLI with Bun and sets Cartethyia’s user configuration directory; reviewed runtime paths showed no confirmed credential export or unrelated account action.
The flagged catalog blob is documented as a packed, compressed offline model catalog, not an executable payload.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

11 flagged

src/providers/discovery/catalog/catalog-blob.tsView file

Lines 1-19typescript

1/**

2 * GENERATED — do not edit.

3 *

4 * The packed, brotli-compressed offline model catalog for `ModelsDevCatalog`.

5 * Rebuild with `bun run scripts/generate/models-catalog.ts`.

6 *

7 * Sources: models.dev (pricing, every provider) and models.opencode.ai (the

8 * authoritative limits for the OpenCode family).

9 *

10 * Fetched 2026-10-17T02:27:15.774Z · 8941 rows · 232 providers ·

11 * 2482 global price keys · 2700 cost tuples ·

12 * 584 KB packed → 105 KB brotli.

13 */

14export const CATALOG_BLOB_BROTLI_BASE64 =

15 "W+8emQdV425rrlcwIcLm0TafQvFcBecKemwnIdXjmFTUCwpv7wx6+ziF6E5SFds5b51i+v//////35dMYs78fbjkB4JVqHVUraNT6RJCIyKiMPSQCWRhgdWia6sxIyjC5nY9TPOGlDl8IFwQLoVokFEew5Vabgt8IhzV1lTb5AS3hDvCZ7zHB3zExC+DkCU48WxycbnyNWXPzKS4BSYDJQWUkbIpby7vJQ1BCl362Ye49KEJESkVnPEeOnCV7ecX0cpu6M7UtKnlBA0t4u+Yep0LlW54rr5ehImqGY+KF7xqbG1+zTADqrZ6ram7/sWiixqpZmLQCKmX1cosoS6LIUIjnmDpYWJ0aStMhAkWxjt0Rq+Lw8TojCc94urwm5CExD/4gA/4iLsS/StEjD/p7eW4+6sMGDJkOMrVlm5CIYl2xP+McTPZvA83rr4ZDHIJAUewWqAbKQxj8qJ9qBXldVQK9QT9w+DQRlEXGQMuwZln3HzQaBErZS6/jVM4wTC9ur9JbjC4OVCi3RwQCIAunD9IYSG2gSdzLJlM7b/ydxWXulR1Vw2yjGcNEk+Aw/p7NausmB3A3qvaqv1xcMILN ...

High

High Secret

Package contains a high-severity secret pattern.

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

17/** Byte length of the blob *after* decompression, so a reader can preallocate. */

18export const CATALOG_BLOB_BYTES = 597744;

Long lines were clipped for display.

15patternName = google_api_key severity = high line = 15

High

Secret Pattern

Google API key in src/providers/discovery/catalog/catalog-blob.ts

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

scripts/cli/cli.tsView file

Lines 1-22typescript

1import { randomBytes } from "node:crypto";

2import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

3import { spawn, type ChildProcess } from "node:child_process";

4import { tmpdir } from

dist/dashboard/assets/entry-DcX5sMzh.jsView file

Lines 1-4javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/LoginPage-CL2GR7wU.js","assets/jsx-runtime-CXUMngI_.js","assets/toast-DKAdP2mo.js","assets/app-BDJWMThu.js","assets/app-Cjgo4-Lf.css","assets/log-in-BmRjy60c.js","assets/query-keys-ROf-g1Wi.js",

src/providers/integrations/qoder/qoder.tsView file

Lines 11-51typescript

11import { readCredentialSecret, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext } from "../../provider-contracts";

12import type { ModelDefinition } from "../../provider-model-definition";

13import { parseQoderOAuthState } from

scripts/cli/cli-launcher.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const { randomUUID } = require("node:crypto");

src/boot/dependencies.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/boot/dependencies.ts#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged · loading source

src/providers/discovery/catalog/catalog-blob.tsView file

15patternName = google_api_key severity = high line = 15

High

High Secret

Package contains a high-severity secret pattern.

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

15patternName = google_api_key severity = high line = 15

High

Secret Pattern

Google API key in src/providers/discovery/catalog/catalog-blob.ts

src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15

scripts/cli/cli.tsView file

2Source sends the broad process environment to a literal external destination. L2: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; L3: import { spawn, type ChildProcess } from "node:child_process"; L4: import { tmpdir } from "node:os"; ... L10: L11: process.env.CARTETHYIA_CONFIG_DIR ??= resolveUserConfigDir(); L12: ... L29: throw new Error( L30: `Bun ${MINIMUM_BUN_VERSION} or newer is required (found ${Bun.version}). Install it from https://bun.sh and run this command again.`, L31: ); ... L71: try { L72: const parsed: unknown = JSON.parse(readFileSync(signalPath, "utf8")); L73: if (parsed !== null && typeof parsed === "object" && "status" in parsed) {

Findings

1 Critical8 High4 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationscripts/cli/cli.ts

HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts

HighChild Processscripts/cli/cli.ts

HighEntrypoint Build Divergencescripts/cli/cli-launcher.cjs

HighSame File Env Network Executionscripts/cli/cli.ts

HighSandbox Evasion Gated Capabilityscripts/cli/cli.ts

HighRuntime Package Installscripts/cli/cli.ts

HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1

HighSecret Patternsrc/providers/discovery/catalog/catalog-blob.ts

MediumDynamic Requiredist/dashboard/assets/entry-DcX5sMzh.js

MediumNetwork

Affected versions and remediation

This report applies to cartethyia@2.3.0.

See all versions of cartethyia for other recorded verdicts.

Review the evidence and your use of cartethyia@2.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 02:55:25.212Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.