registry / cartethyia / 2.3.1
cartethyia@2.3.1
A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged CLI operations are package-aligned version checking, local gateway management, and user-invoked updating; the apparent secret match is compressed offline model catalog content. The package manifest has no install lifecycle hook, and the inspected source does not establish credential exfiltration or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI; npm installation is triggered by the explicit update command or tray update action.
Impact
No confirmed attack surface was established from these behaviors.
Mechanism
The version lookup reads package metadata from the npm registry; gateway health and drain requests target localhost. The inspected requests do not transmit saved credentials to an unrelated recipient.
AI rationale
The flagged CLI operations are package-aligned version checking, local gateway management, and user-invoked updating; the apparent secret match is compressed offline model catalog content. The package manifest has no install lifecycle hook, and the inspected source does not establish credential exfiltration or another concrete attack.
Network endpoints3
registry.npmjs.org/cartethyia/latest127.0.0.1:${port}/health127.0.0.1:${port}/admin/drain
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines development, build, setup, and packaging scripts, with no preinstall, install, or postinstall hook. The CLI checks npm for the latest version, probes the local gateway, and starts setup, gateway, tray, or update only through explicit commands. The generated catalog identifies itself as a compressed offline model catalog; inspected required source locations describe gateway, provider, transport, network, persistence, and security functions.
Evidence against
- Scanner labels the CLI as credential exfiltration and flags the catalog as containing a secret, but the inspected CLI sends no credentials in its npm version check, and the flagged catalog is compressed offline catalog data.
- The CLI can run npm to update Cartethyia, but the inspected calls are reached through the explicit update command or tray update action. No package-install lifecycle trigger was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
11 flagged · loading sourcesrc/providers/discovery/catalog/catalog-blob.tsView file
15patternName = google_api_key
severity = high
line = 15
High
High Secret
Package contains a high-severity secret pattern.
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L1515patternName = google_api_key
severity = high
line = 15
High
Secret Pattern
Google API key in src/providers/discovery/catalog/catalog-blob.ts
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15scripts/cli/cli.tsView file
2Source sends the broad process environment to a literal external destination.
L2: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
L3: import { spawn, type ChildProcess } from "node:child_process";
L4: import { tmpdir } from "node:os";
...
L10:
L11: process.env.CARTETHYIA_CONFIG_DIR ??= resolveUserConfigDir();
L12:
...
L29: throw new Error(
L30: `Bun ${MINIMUM_BUN_VERSION} or newer is required (found ${Bun.version}). Install it from https://bun.sh and run this command again.`,
L31: );
...
L71: try {
L72: const parsed: unknown = JSON.parse(readFileSync(signalPath, "utf8"));
L73: if (parsed !== null && typeof parsed === "object" && "status" in parsed) {
Findings
1 Critical8 High4 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/cli/cli.ts
HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts
HighChild Processscripts/cli/cli.ts
HighEntrypoint Build Divergencescripts/cli/cli-launcher.cjs
HighSame File Env Network Executionscripts/cli/cli.ts
HighSandbox Evasion Gated Capabilityscripts/cli/cli.ts
HighRuntime Package Installscripts/cli/cli.ts
HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1
HighSecret Patternsrc/providers/discovery/catalog/catalog-blob.ts
MediumDynamic Requiredist/dashboard/assets/entry-C3M9aRLH.js
MediumNetwork
Affected versions and remediation
This report applies to cartethyia@2.3.1.
See all versions of cartethyia for other recorded verdicts.
- Review the evidence and your use of cartethyia@2.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.