Supply Chain Billion-Context LLM Proxy Middleware

How the attack works

An attacker or unwitting developer fetches the 'billion-context' package from npm or a CDN, or it appears in a project's dependency manifest or lockfile. It then gets loaded at runtime — visible via a distinctive HTTP header, user-agent string, environment variables, or an import/require call. In its most concerning form, the package name appears together with a change to the Anthropic or OpenAI API base URL, meaning the agent's traffic is being redirected through this proxy instead of going straight to the model provider. Once in that position, the proxy sees every system prompt, tool result, and model response in plaintext and can alter any of it before either side notices.

Netzilo detection

Why it matters

An organization using this proxy in front of its AI agents loses confidentiality of its prompts and model outputs, and loses assurance that responses haven't been tampered with in transit — a single compromised or malicious middleware component can expose or manipulate all AI agent traffic.

What you can do

• →Inventory all AI agent configurations for base-URL overrides pointing to non-official endpoints, and confirm any proxy in that path is approved.
• →Treat any appearance of 'billion-context' in package manifests, lockfiles, or runtime environment variables as a dependency requiring explicit security review, not silent adoption.
• →Restrict who can change API base-URL settings for coding agents, since redirecting model traffic through a third party is the highest-impact step this rule watches for.
• →If the package is already in use, verify the maintainer, review what it does with intercepted traffic, and remove it if its behavior can't be fully audited.

Known benign look-alikes

• A developer deliberately evaluating or installing billion-context. The registry metadata fetch and tarball download will fire. This is intended -- treat it as an inventory/approval signal for a component that terminates model API traffic.
• A security researcher or an agent browsing the package page or a source repository whose path ends in /billion-context. Partially suppressed by the advisory+analysis filter pair; report-only action bounds the impact.
• A repository that already depends on billion-context being synced, mirrored or published over HTTP -- every request carrying the package.json, package-lock.json, yarn.lock or pnpm-lock.yaml will re-fire sel_manifest_dep. Expect repeat alerts from the same peer until the dependency is removed or approved.
• Blog posts, changelogs or READMEs that quote an `npx billion-context` install line being fetched or posted by an agent. Only partially suppressed; the documentation must also carry advisory vocabulary to be filtered.
• Unrelated software that happens to define a JSON/JS `baseUrl` next to the literal string billion-context in the same body. The AND of sel_bc_token and sel_api_base_override makes this unlikely but not impossible.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1557/
• https://atlas.mitre.org/techniques/AML.T0010
• https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/

Related threats