registry / cartethyia / 2.5.1
cartethyia@2.5.1
⚠ Under reviewA powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and response
Static Scan Results
scanned 2d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 24 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
15 flagged · loading sourcesrc/providers/discovery/catalog/catalog-blob.tsView file
15patternName = google_api_key
severity = high
line = 15
High
High Secret
Package contains a high-severity secret pattern.
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L1515patternName = google_api_key
severity = high
line = 15
High
Secret Pattern
Google API key in src/providers/discovery/catalog/catalog-blob.ts
src/providers/discovery/catalog/catalog-blob.tsView on unpkg · L15dist/dashboard/assets/entry--yj84zk3.jsView file
3L4: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let u=W(),d;if(t){let e=typeof t==`string`?yt(t):t;P(c===`/`||e.pathname?.startsWith(c),`W...
Medium
Findings
11 High6 Medium7 Low
HighHigh Secretsrc/providers/discovery/catalog/catalog-blob.ts
HighEntrypoint Build Divergencescripts/cli/bin/cartethyia.cjs
HighShips High Entropy Blobdist/dashboard/assets/ProxyPage-wvk0ciQN.js.gz
HighSemantic Analysis Limitedsrc/boot/dependencies.ts#virtual:normalized:round1
HighKnown Malware Source Similaritysrc/console/cli-tools/fs-ops.ts
HighKnown Malware Source Similaritydist/dashboard/assets/quota-DZGyp0N5.js
HighKnown Malware Source Similaritysrc/console/console-router.ts
HighKnown Malware Source Similaritysrc/console/routing/pools/probe-result.ts
HighKnown Malware Source Similaritysrc/protocol/codecs.ts
HighPrevious Version Dangerous Deltascripts/cli/bin/cartethyia.cjs
Affected versions and remediation
This report applies to cartethyia@2.5.1.
See all versions of cartethyia for other recorded verdicts.
- Review the evidence and your use of cartethyia@2.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.