registry / cartethyia / 2.3.2
cartethyia@2.3.2
A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response
AI Security Review
scanned 5d ago · by lpm-firewall-aiSource inspection did not substantiate the scanner’s credential-exfiltration or runtime-install claims: the CLI’s external request checks version metadata, and its package update is user-triggered. No install lifecycle hook or concrete attack behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the command-line application; updating requires a menu or tray update action.
Impact
No credential disclosure or other harmful effect was established in the inspected source.
Mechanism
The inspected code reads release metadata from the npm registry, checks local gateway endpoints, and launches a global package update after the update action.
AI rationale
Source inspection did not substantiate the scanner’s credential-exfiltration or runtime-install claims: the CLI’s external request checks version metadata, and its package update is user-triggered. No install lifecycle hook or concrete attack behavior was identified.
Evidence
package.jsonscripts/cli/cli.tsscripts/cli/cli-launcher.cjssrc/providers/discovery/catalog/catalog-blob.ts
Network endpoints2
registry.npmjs.org127.0.0.1
Decision evidence
public snapshotAI called this Clean at 85.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes command-line entrypoints and shows development, packaging, and setup scripts; it has no preinstall, install, or postinstall hook.
- The inspected CLI uses the npm registry for version checks and runs a global update only after a menu or tray update action. Its other inspected network calls target the local gateway.
- The flagged catalog file describes a generated offline model catalog. The cited runtime and support paths identify gateway, routing, authentication, provider, and observability components; the inspected excerpts establish no attack behavior.
Evidence against
- Scanner labels alleged credential exfiltration and runtime installation, but inspected CLI network requests check package version or contact the local gateway; the global package update is tied to a user-selected update action.
- No concrete credential transfer, install-time mutation, or malicious behavior was established in the inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
12 flagged · loading sourcesrc/providers/discovery/catalog/catalog-blob.tsView file
15patternName = google_api_key
severity = high
line = 15
High
High Secret
Package contains a high-severity secret pattern.
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L1515patternName = google_api_key
severity = high
line = 15
High
Secret Pattern
Google API key in src/providers/discovery/catalog/catalog-blob.ts
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15scripts/cli/cli.tsView file
2Source sends the broad process environment to a literal external destination.
L2: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
L3: import { spawn, type ChildProcess } from "node:child_process";
L4: import { tmpdir } from "node:os";
...
L11:
L12: process.env.CARTETHYIA_CONFIG_DIR ??= resolveUserConfigDir();
L13:
...
L35: throw new Error(
L36: `Bun ${MINIMUM_BUN_VERSION} or newer is required (found ${Bun.version}). Install it from https://bun.sh and run this command again.`,
L37: );
...
L77: try {
L78: const parsed: unknown = JSON.parse(readFileSync(signalPath, "utf8"));
L79: if (parsed !== null && typeof parsed === "object" && "status" in parsed) {
Findings
2 Critical8 High4 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/cli/cli.ts
CriticalPrevious Version Dangerous Deltascripts/cli/cli-launcher.cjs
HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts
HighChild Processscripts/cli/cli.ts
HighEntrypoint Build Divergencescripts/cli/cli-launcher.cjs
HighSame File Env Network Executionscripts/cli/cli.ts
HighSandbox Evasion Gated Capabilityscripts/cli/cli-launcher.cjs
HighRuntime Package Installscripts/cli/cli.ts
HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1
HighSecret Patternsrc/providers/discovery/catalog/catalog-blob.ts
Medium
Affected versions and remediation
This report applies to cartethyia@2.3.2.
See all versions of cartethyia for other recorded verdicts.
- Review the evidence and your use of cartethyia@2.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.