incidents.si
INC-2025-0017SEV2 · Highsupply-chainconfirmed

Fake "postmark-mcp" npm package secretly copies every email to its author

An npm package that copied Postmark’s MCP server worked normally for 15 versions, then added a line that blind-copied every outgoing email to an outside address.

Occurred
Disclosed
Published
Organization
Postmark (impersonated; not the publisher)
System
MCP server for sending email, distributed on npm
Impact
Emails sent by AI assistants through the package were copied to an outside address; 1,643 total downloads
Root cause
One added line in version 1.0.16 of an unofficial package

Timeline

  • 2025-09-15. The package is uploaded to npm, according to The Hacker News.
  • 2025-09-17. Version 1.0.16 adds the malicious line.
  • 2025-09-25. Postmark publishes its notice.
  • Later. The author deletes the package from npm.

Trigger or entry point

Developers installed an unofficial npm package that used Postmark’s name and copied its legitimate MCP server.

Failure mechanism

According to Koi Security, as reported by The Hacker News, the package was a copy of the official library with one change in version 1.0.16: every email sent through the MCP server was blind-copied to an address controlled by the package author. Nothing else changed, so assistants kept sending email as before. The Hacker News reports that the author’s npm account maintained 31 other packages. Postmark notes that the package had built trust over 15 versions before the change.

Impact

The package had 1,643 downloads in total. Any email an assistant sent through it could contain sensitive content such as password resets or invoices. Emails already copied cannot be recalled. Snyk, quoted in the same report, points out that MCP servers usually run with high trust and broad permissions inside agent toolchains.

Response

Postmark stated that it had no involvement with the package, that it had not published its MCP server on npm before the incident, and that its own API and services were unaffected.

Mitigations

Postmark and the researchers advise removing the package, checking email logs and rotating any credentials that were sent by email in the period.

Sources

  1. Information Regarding Malicious "postmark-mcp" Packageprimary · 2025-09-25
  2. First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Packagesecondary · 2025-09-29

Corrections

No corrections have been made to this entry.

Report a correction