registry / cartethyia / 2.4.5
cartethyia@2.4.5
⚠ Under reviewA powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response
Static Scan Results
scanned 5d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 29 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
20 flagged · loading sourcesrc/providers/discovery/catalog/catalog-blob.tsView file
15patternName = google_api_key
severity = high
line = 15
High
High Secret
Package contains a high-severity secret pattern.
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L1515patternName = google_api_key
severity = high
line = 15
High
Secret Pattern
Google API key in src/providers/discovery/catalog/catalog-blob.ts
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15dist/dashboard/assets/entry-Cpi0rph1.jsView file
3L4: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let u=G(),d;if(t){let e=typeof t==`string`?R(t):t;F(c===`/`||e.pathname?.startsWith(c),`Wh...
Medium
Findings
17 High5 Medium7 Low
HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts
HighEntrypoint Build Divergencescripts/cli/cli-launcher.cjs
HighSandbox Evasion Gated Capabilityscripts/cli/cli.ts
HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/cli/setup.ts
HighKnown Malware Source Similarityscripts/operations/restart.ts
HighKnown Malware Source Similarityscripts/operations/probe-egress.ts
HighKnown Malware Source Similaritysrc/console/cli-tools/fs-ops.ts
HighKnown Malware Source Similaritysrc/persistence/db-pg.ts
HighKnown Malware Source Similaritydist/dashboard/assets/quota-DZGyp0N5.js
Affected versions and remediation
This report applies to cartethyia@2.4.5.
See all versions of cartethyia for other recorded verdicts.
- Review the evidence and your use of cartethyia@2.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.