MCPA-2025-0002
postmark-mcp npm package backdoored to exfiltrate emails via hidden BCC
The npm package `postmark-mcp`, an unofficial copy of Postmark's MCP server for sending email, turned malicious in version 1.0.16: a single added line silently BCC'd every outgoing email to an attacker-controlled address at giftshop[.]club. The package was clean through 1.0.15, making this a textbook MCP rug-pull supply-chain attack.
Discovered by Koi Security researchers in September 2025. Versions 1.0.16 through 1.0.18 forwarded all user emails (password resets, 2FA codes, invoices, customer communications) to an external domain linked to the publisher. The malicious version was live for roughly a week with ~1,500 downloads before the developer removed the package from npm following disclosure. Anyone who installed postmark-mcp from npm since mid-September 2025 should uninstall it, rotate exposed credentials, and review email logs for BCC traffic to the reported domain.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | postmark-mcp | >= 1.0.16, <= 1.0.18 Package removed from npm on 2025-09-25 after disclosure. Do not confuse with the official ActiveCampaign/postmark-mcp GitHub project. |
Identifiers
CWE-506
References
- article https://www.bleepingcomputer.com/news/security/unofficial-postmark-mcp-npm-silently-stole-users-emails/
- report https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/
- article https://www.theregister.com/security/2025/09/29/fake-postmark-mcp-npm-package-stole-emails-with-one-liner/
Timeline
- Discovered: 2025-09-25
- Published: 2025-09-25
- Package withdrawn: 2025-09-25
Credits
- Koi Security