Fake 'postmark-mcp' npm package secretly BCC'd users' emails to an attacker server

Developers who installed the unofficial postmark-mcp package (Postmark/ActiveCampaign impersonated)·postmark-mcp (malicious MCP server on npm)

A malicious actor published an npm package impersonating Postmark's MCP server, built up trust over 15 versions, then added a backdoor in version 1.0.16 that silently BCC'd every email an integrated AI agent sent through it to an external server.

Blast radius

All emails sent via the fake MCP server by any AI coding agent configured to use it were covertly copied to the attacker, including any credentials or sensitive data emailed during the compromise window.

Root cause

Users and agent tooling installed an unverified, impersonating MCP package instead of Postmark's official integration, and the MCP trust model does not verify server provenance.

How it was caught

Identified and publicized by the Postmark team and security researchers (Qualys, Snyk) after the backdoored version had already been distributed.

What changed

Postmark issued a public warning; affected users told to remove the package and rotate any credentials emailed during the compromise period.

Take-awayVet MCP servers and their publishers before wiring an agent to them; a trusted-sounding package name is not proof of provenance.