// Suspicious network destinations

Pastebin / paste-service exfiltration

패턴: pastebin-domain

Packages that POST data to pastebin.com, dpaste, hastebin, transfer.sh, or similar public paste services. A low-effort exfil destination where the attacker can later download the dump.

3개 패키지에 이 패턴이 매칭됨 (총 publish 이벤트 7건을 publisher+name 기준으로 묶음). 최신순.

• AUTO-PUBLISHED/npm/2026-06-04

  nodmix4 versions·2026.5.30→2026.5.35

  by nodmix

  Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

  steals →AI API keys→ sends tohttps://nodmix.com

  reads-env-varsreads-homedirchild-process-spawnpastebin-domainpublic-github-pusharchive-then-uploadreads-ai-api-keys
• AUTO-PUBLISHED/npm/2026-06-04

  @qaecy/cue-ui2 versions·0.0.23→0.0.25

  by madsholten

  QAECY UI Web Components

  → sends tohttps://docs.mapbox.com/mapbox-gl-js/guides/install/#transpiling

  reads-env-varsbase64-decodechild-process-spawnpastebin-domainfunction-constructorlong-base64-literalclipboard-accesslong-hex-literal+2
• AUTO-PUBLISHED/npm/2026-06-03

  pokebedrock-showdown@0.1.17

  by smell-of-curry

  A modified version of the Pokémon Showdown server, designed for PokeBedrock.

  steals →Azure credsChromium logins

  public-github-pushreads-chromium-credsreads-azure-credschild-process-spawninstall-path-npm-publisheval-dynamicpastebin-domainreads-env-vars

  크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 pastebin-domain 조합 — 전형적인 유출 패턴.