Cartesia Speech

• Analyzed: May 12, 2026, 10:00 PM
• Findings: 1
• Version: 0.2.3
• Hash: 21af900ec3314c06ad8d68c4aa5e5e0e75fb86de91438fae23487ea1b1212aad
• Source: palm
• External report: View on VirusTotal

Findings (1)

Package: openclaw-cartesia (npm) Version: 0.2.3 Description: OpenClaw speech provider plugin for Cartesia Sonic-2 — high-quality TTS with voice cloning, drop-in for messages.tts and talk surfaces (Telegram voice notes, etc.). The package acts as an integration plugin for the OpenClaw platform, providing a Text-to-Speech (TTS) service using the external Cartesia API. It utilizes standard network communication (`fetch`) for API requests, handles authentication using API keys retrieved from configuration or environment variables, and performs necessary audio transcoding. Transcoding from PCM to OGG/Opus for voice notes is accomplished by executing the external system binary `ffmpeg` via `node:child_process.spawn`. The arguments passed to `ffmpeg` are strictly controlled and derived from constants or validated internal parameters, mitigating the risk of command injection. The plugin logic also includes a feature to suppress duplicate text replies after successful voice note synthesis, implemented safely via an OpenClaw message hook. The code adheres to expected functionality and does not contain malicious behavior or obvious critical vulnerabilities.