Malicious postmark-mcp npm package forwarded user emails to an attacker

A fake npm package called postmark-mcp was identified as the first known malicious MCP server, an AI integration tool that automatically forwarded email to threat actors.

Dark Reading reported the discovery on September 29, 2025, citing researchers at Koi Security.

What happened

Researchers at Koi Security found the package on the npm repository, where it masqueraded as a legitimate tool for enabling AI assistants to send automated emails via Postmark's platform.

The package is believed to be the first publicly documented malicious MCP server.

The first 15 versions of postmark-mcp that the publisher released on npm were legitimate and worked exactly as expected.

In the 16th version, the publisher added a BCC command in line 231 of the code that ensured all email sent through the package would also get copied to the engineer.

All it took to poison the package was the single line Bcc: phan@giftshop.club.

Impact

Hundreds of organizations may have been unknowingly funneling emails containing passwords, API keys, financial details, and other sensitive data straight to a threat actor through the poisoned package.

An estimated 1,500 organizations may have downloaded the malicious package.

Even if just 20% were actually using it, Koi Security said that would mean about 300 organizations were sending emails containing sensitive data directly to cybercriminals.

Response

The Paris-based engineer behind the package quickly removed the poisoned postmark-mcp from npm after Koi inquired about it, though it was still likely receiving emails from organizations continuing to use it.

Postmark could theoretically have published its own official npm package to claim the namespace, or monitored for unauthorized copies of its code.

Lessons for security leaders

Such MCP tools often operate with full permissions and little oversight, creating a new and convenient attack vector for cybercriminals.

Organizations can mitigate some of the problems by verifying packages come from official sources, checking for a GitHub repo versus npm publisher mismatch.

It is also important to implement approval processes for MCP servers, monitor for behavioral changes between versions, and establish security reviews for AI tool integrations.