Loading story…
GitHub announced a broader plan to harden the npm supply chain as a malicious package on the registry highlighted how attackers can abuse trust in emerging AI tooling. The package, postmark-mcp, impersonated or reposted a legitimate Model Context Protocol (MCP) server for the Postmark email service and later introduced a subtle payload rather than overt malware, underscoring the risk of seemingly benign packages in public repositories.
According to reporting on the incident, the malicious MCP package silently added a BCC recipient to emails sent through an AI agent, potentially leaking password resets, security alerts, receipts, and other sensitive messages to an attacker-controlled address. The case was described as a software supply-chain attack adapted to the MCP ecosystem, and recommendations focused on using official MCP servers from trusted sources, enforcing least privilege and authentication, reviewing code, and strengthening package verification as npm security controls evolve.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
A malicious npm package named postmark-mcp was identified as impersonating or reposting a legitimate MCP server for the Postmark email service. The package later introduced a subtle payload that added a BCC recipient to emails sent through an AI agent, potentially exposing sensitive messages to an attacker-controlled address.
GitHub published a plan for a more secure npm supply chain, outlining security changes for the npm ecosystem. The announcement marks a formal response to supply-chain risk in the package registry.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious version of the npm package postmark-mcp, designed to act as a Model Context Protocol (MCP) server for AI assistants to send emails through the Postmark service, was discovered to be exfiltrating user emails by surreptitiously adding a blind carbon copy (BCC) to an external domain. The package, which appeared to be a legitimate port of the official Postmark MCP server, was published on npm and underwent rapid version iterations between September 15 and September 17, 2025. According to security researchers, the malicious behavior was introduced in version 1.0.16, which added a single line of code to forward all outbound emails to an external address at giftshop[.]club, controlled by the package's developer. This backdoor persisted in subsequent versions, including 1.0.18, and was not present in earlier releases. The package was downloaded approximately 1,500 times during the week it was available, potentially exposing thousands of sensitive emails, including password resets, two-factor authentication codes, financial information, and customer communications. The malicious package was a near-identical replica of the authentic GitHub project, making it difficult for users to distinguish between the legitimate and compromised versions. The abrupt removal of all third-party dependencies in version 1.0.18 suggested attempts to evade detection or launder the package's history. MCP servers typically operate with high trust and broad permissions, meaning any compromise can have significant security implications for organizations relying on agentic workflows. Security experts recommend that anyone who installed or used postmark-mcp since mid-September 2025 should immediately uninstall the package, rotate any credentials that may have been exposed, and review email logs for evidence of BCC traffic to the malicious domain. The incident underscores the risks inherent in supply chain attacks, particularly when attackers impersonate trusted open-source components. The official MCP server hosted by ActiveCampaign on GitHub was not compromised, but the existence of a similarly named and described package on npm facilitated the attack. The developer responsible for the malicious package removed it from npm after the issue was publicized, but not before significant data exposure had occurred. The case highlights the need for rigorous auditing of third-party packages, especially those with access to sensitive communications. Security researchers and media outlets have called for increased vigilance and monitoring of MCP servers and similar components in AI-driven environments. The incident is notable as one of the first widely reported supply chain attacks involving a malicious MCP server targeting AI assistant workflows. Organizations are urged to audit their environments for the presence of the compromised package and to implement stricter controls over the adoption of open-source dependencies. The attack demonstrates how a single line of code in a widely used package can have far-reaching consequences for data privacy and organizational security.
Jun 29, 2026
A new wave of supply chain attacks has targeted developers through malicious npm packages and GitHub repositories, with attackers leveraging both automated worms and sophisticated social engineering. The npm registry was compromised by a self-replicating worm known as "Sha1-Hulud: The Second Coming," which infected over 800 packages and 27,000 GitHub repositories. The malware aimed to steal sensitive data such as API keys, cloud credentials, and authentication tokens, and it backdoored npm packages to execute malicious payloads during installation. Attackers also abused GitHub Actions workflows for command-and-control and data exfiltration, with a notable shift to using the Bun runtime for improved stealth and evasion of Node.js-focused defenses. In a related attack vector, threat actors used fake job interviews to lure developers into cloning and running seemingly benign Next.js projects from private GitHub repositories. The malicious code was hidden in the `next.config.js` file, which executed on the developer's machine during project setup, bypassing traditional dependency-based detection. This "Living off the Land" technique enabled the theft of credentials, including those for LastPass and cryptocurrency wallets, by exploiting trusted development workflows. Both incidents highlight the growing risk of supply chain attacks targeting developers through trusted tools and social engineering tactics.
Jun 29, 2026
A supply-chain malware campaign known as **Shai-Hulud** compromised hundreds of packages in the npm ecosystem and later spread into both npm and PyPI, using stolen maintainer credentials and trusted publishing workflows to push trojanized releases. Early reporting said the worm affected more than 500 npm packages, searched infected developer and CI/CD environments for GitHub Personal Access Tokens, cloud API keys, and other secrets, and exfiltrated them to attacker-controlled infrastructure and public GitHub repositories. GitHub removed hundreds of malicious packages, while CISA urged organizations to review dependencies, check for cached malicious packages, rotate credentials, and enforce phishing-resistant MFA for developer accounts. Later waves became more aggressive and broader in scope. Researchers said a second campaign hit hundreds more npm packages and had a blast radius exceeding **27,000 repositories**, abusing `preinstall` and other lifecycle hooks to steal secrets, hijack GitHub Actions, self-propagate into additional packages, and in some cases deploy a conditional wiper-like payload. A subsequent **Mini Shai-Hulud** wave affected more than 170 packages across npm and PyPI, including packages tied to TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, and others; it used files such as `router_init.js`, invoked Bun through malicious package scripts, targeted npm, GitHub, cloud, Kubernetes, Vault, and CI/CD credentials, and demonstrated that provenance and OIDC-based trusted publishing can still be abused when attacker-controlled code runs inside legitimate release workflows.
Jun 30, 2026