EE
FR Contact

Fake postmark-mcp server secretly copies emails sent by AI assistants to an attacker

In the wild Manipulation Severity 3 significant Corroborated 89%

An npm package called postmark-mcp, posing as an MCP server for the Postmark email service, added a hidden BCC in version 1.0.16 that copied every email sent through it to an address on an attacker-controlled domain. AI assistants using the server to send email therefore leaked each message without users noticing. Postmark said it had nothing to do with the package, which disappeared from npm after Koi Security contacted the publisher.

The publisher had built trust over 15 versions before adding the backdoor, and CSO Online reported about 1,500 weekly downloads. Users were advised to remove the package, rotate any credentials sent by email and audit the MCP servers they run.

What would have stopped it

Install MCP servers only from verified publishers and pin and review versions before updating.

Guardrails

4 of 8 failed
  1. G1 Least privilege Failed The MCP server held full send access to users' email with the assistant's own privileges.
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed A poisoned third-party tool was installed and used with no verification of its publisher or updates.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Failed The hidden BCC was invisible to users until an outside scanner flagged version 1.0.16.
  8. G8 Recovery Failed Copied emails cannot be recalled; deleting the package did not remove installed copies.

Sources

1 primary, 2 specialist
  1. Security Alert: Malicious 'postmark-mcp' npm Package Impersonating Postmark Postmark, 25 Sep 2025
    “Here's what happened: A malicious actor created a fake package on npm impersonating our name, built trust over 15 versions, then added a backdoor in version 1.0.16 that secretly BCC’d emails to an external server.”
    Primary Quote checked Archived copy
  2. Malicious MCP Server on npm postmark-mcp Harvests Emails Snyk, 25 Sep 2025
    “Current analysis suggests the behavior began around 1.0.16 and persisted in later versions.”
    Specialist Quote checked Archived copy
  3. Trust in MCP takes first in-the-wild hit via squatted Postmark connector CSO Online, 26 Sep 2025
    “Once the version was published, each time the tool sent an email, it also silently forwarded a copy to phan@giftshop.club, a domain tied to the attacker.”
    Specialist Quote checked Archived copy

Confidence 89% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2026-001 Jan 2026 Hundreds of malicious ClawHub skills for OpenClaw agents deliver infostealer malware OpenClaw with ClawHub skills 91%
  2. EEAIR-2026-014 May 2026 Meta AI support chatbot is tricked into handing attackers control of Instagram accounts Meta AI support assistant 67%
  3. EEAIR-2025-024 Aug 2025 Tokens stolen from Salesloft's Drift chat agent used to raid hundreds of Salesforce orgs Salesloft Drift 96%