Supply Chain Copilot API Proxy Shim Exposure

How the attack works

An attacker or unwitting developer installs or runs the @ascdong/copilot-proxy package, or pins it in a project's dependency file. That package (or an equivalent shim) then intercepts a live Copilot session token and re-exposes it through a local endpoint shaped like an OpenAI or Anthropic API. A CLI agent is then pointed at this endpoint by overriding its base-URL and auth-token environment variables, so the agent's requests get silently routed through the shim using the stolen Copilot credentials. The rule watches for the package name plus an install/run action, or for the proxy's runtime marker showing up together with either a base-URL/auth-token override or a live Copilot/GitHub session token.

Netzilo detection

Why it matters

An organisation's Copilot credentials can be siphoned and reused outside GitHub's own client, and AI agent traffic can be silently rerouted through an unofficial proxy, undermining assumptions about which service is actually handling requests and data.

What you can do

• →Block or review installations of the @ascdong/copilot-proxy package and similar Copilot-compatibility shims in your dependency manifests and lockfiles.
• →Audit any environment variables (ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, or similar) that redirect AI CLI tools to non-default API endpoints, and confirm each one is an approved internal gateway.
• →Treat any co-occurrence of a Copilot session token with a custom API endpoint override as worth investigating, even if the package name is not present.
• →If you knowingly run an internal Copilot proxy for legitimate reasons, document it so alerts on this pattern can be triaged quickly instead of treated as unknown incidents.

Known benign look-alikes

• Security or platform engineers deliberately installing @ascdong/copilot-proxy in a sandbox to reproduce or triage the supply-chain issue. filter_remediation suppresses uninstall/audit/view flows but not a deliberate reinstall.
• An agent fetching the npm registry page, GitHub README or a dependency-review report for the package, where the quickstart text contains "npx @ascdong/copilot-proxy". filter_docs suppresses advisory-worded pages but not a plain README.
• An organisation that intentionally brokers Copilot through an approved internal gateway and sets ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN for Claude Code. This matches branch 2 only when a Copilot-proxy marker is also present in the same event, which is the exact configuration the rule is meant to surface for review.
• Local OpenAI-compatible gateways (LiteLLM, Ollama, vLLM) exposing /v1/chat/completions on loopback during development. These match only if a Copilot marker appears in the same payload.
• Verbose HTTP debug traces from the official Copilot extension that echo a tid=...;exp=... session token, if that trace is also read by an agent tool and happens to contain the string "copilot-proxy" (e.g. copilot-proxy.githubusercontent.com). Report-only, so this costs an analyst a look, not a blocked request.
• CI dependency-scanning output listing the package as a transitive dependency; suppressed by filter_remediation when emitted by npm ls/audit, not suppressed for third-party scanners.

References

• https://attack.mitre.org/techniques/T1195/001/
• https://attack.mitre.org/techniques/T1528/
• https://atlas.mitre.org/techniques/AML.T0010

Related threats