registry / cartethyia / 2.4.6
cartethyia@2.4.6
⚠ Under reviewA powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response
Static Scan Results
scanned 4d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 26 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
17 flagged · loading sourcesrc/providers/discovery/catalog/catalog-blob.tsView file
15patternName = google_api_key
severity = high
line = 15
High
High Secret
Package contains a high-severity secret pattern.
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L1515patternName = google_api_key
severity = high
line = 15
High
Secret Pattern
Google API key in src/providers/discovery/catalog/catalog-blob.ts
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15dist/dashboard/assets/entry-7dpgvpJ3.jsView file
3L4: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let u=H(),d;if(t){let e=typeof t==`string`?_t(t):t;P(c===`/`||e.pathname?.startsWith(c),`W...
Medium
Findings
13 High6 Medium7 Low
HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts
HighEntrypoint Build Divergencescripts/cli/bin/cartethyia.cjs
HighShips High Entropy Blobdist/dashboard/assets/assert-7J6_LVD3.js.gz
HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1
HighKnown Malware Source Similaritysrc/console/cli-tools/fs-ops.ts
HighKnown Malware Source Similaritysrc/persistence/db-pg.ts
HighKnown Malware Source Similaritydist/dashboard/assets/quota-DZGyp0N5.js
HighKnown Malware Source Similaritysrc/console/api-keys/contracts.ts
HighKnown Malware Source Similaritysrc/console/console-router.ts
HighKnown Malware Source Similaritysrc/console/routing/pools/probe-result.ts
Affected versions and remediation
This report applies to cartethyia@2.4.6.
See all versions of cartethyia for other recorded verdicts.
- Review the evidence and your use of cartethyia@2.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.