// Suspicious network destinations

Pastebin / paste-service exfiltration

pattern: pastebin-domain

Packages that POST data to pastebin.com, dpaste, hastebin, transfer.sh, or similar public paste services. A low-effort exfil destination where the attacker can later download the dump.

3 packages flagged with this pattern (7 total publish events, collapsed by publisher+name). Newest first.

• AUTO-PUBLISHED/npm/2026-06-04

  nodmix4 versions·2026.5.30→2026.5.35

  by nodmix

  Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

  steals →AI API keys→ sends tohttps://nodmix.com

  reads-env-varsreads-homedirchild-process-spawnpastebin-domainpublic-github-pusharchive-then-uploadreads-ai-api-keys
• AUTO-PUBLISHED/npm/2026-06-04

  @qaecy/cue-ui2 versions·0.0.23→0.0.25

  by madsholten

  QAECY UI Web Components

  → sends tohttps://docs.mapbox.com/mapbox-gl-js/guides/install/#transpiling

  reads-env-varsbase64-decodechild-process-spawnpastebin-domainfunction-constructorlong-base64-literalclipboard-accesslong-hex-literal+2
• AUTO-PUBLISHED/npm/2026-06-03

  pokebedrock-showdown@0.1.17

  by smell-of-curry

  A modified version of the Pokémon Showdown server, designed for PokeBedrock.

  steals →Azure credsChromium logins

  public-github-pushreads-chromium-credsreads-azure-credschild-process-spawninstall-path-npm-publisheval-dynamicpastebin-domainreads-env-vars

  Credential read (reads-azure-creds) paired with pastebin-domain destination — classic exfiltration signature.