Loading story…
A malicious version of the npm package postmark-mcp, designed to act as a Model Context Protocol (MCP) server for AI assistants to send emails through the Postmark service, was discovered to be exfiltrating user emails by surreptitiously adding a blind carbon copy (BCC) to an external domain. The package, which appeared to be a legitimate port of the official Postmark MCP server, was published on npm and underwent rapid version iterations between September 15 and September 17, 2025. According to security researchers, the malicious behavior was introduced in version 1.0.16, which added a single line of code to forward all outbound emails to an external address at giftshop[.]club, controlled by the package's developer. This backdoor persisted in subsequent versions, including 1.0.18, and was not present in earlier releases. The package was downloaded approximately 1,500 times during the week it was available, potentially exposing thousands of sensitive emails, including password resets, two-factor authentication codes, financial information, and customer communications. The malicious package was a near-identical replica of the authentic GitHub project, making it difficult for users to distinguish between the legitimate and compromised versions. The abrupt removal of all third-party dependencies in version 1.0.18 suggested attempts to evade detection or launder the package's history. MCP servers typically operate with high trust and broad permissions, meaning any compromise can have significant security implications for organizations relying on agentic workflows. Security experts recommend that anyone who installed or used postmark-mcp since mid-September 2025 should immediately uninstall the package, rotate any credentials that may have been exposed, and review email logs for evidence of BCC traffic to the malicious domain. The incident underscores the risks inherent in supply chain attacks, particularly when attackers impersonate trusted open-source components. The official MCP server hosted by ActiveCampaign on GitHub was not compromised, but the existence of a similarly named and described package on npm facilitated the attack. The developer responsible for the malicious package removed it from npm after the issue was publicized, but not before significant data exposure had occurred. The case highlights the need for rigorous auditing of third-party packages, especially those with access to sensitive communications. Security researchers and media outlets have called for increased vigilance and monitoring of MCP servers and similar components in AI-driven environments. The incident is notable as one of the first widely reported supply chain attacks involving a malicious MCP server targeting AI assistant workflows. Organizations are urged to audit their environments for the presence of the compromised package and to implement stricter controls over the adoption of open-source dependencies. The attack demonstrates how a single line of code in a widely used package can have far-reaching consequences for data privacy and organizational security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting and analysis explained that the package's theft mechanism relied on a minimal code change that secretly copied outbound emails to an attacker-controlled address. Additional writeups provided hunting and detection guidance for affected users and environments.
Researchers publicly reported that postmark-mcp was a malicious MCP server package on npm that harvested emails and potentially other secrets. Coverage described it as the first known malicious MCP server package identified in the ecosystem.
An unofficial npm package named postmark-mcp was published as an MCP server for the Postmark email service. The package contained malicious code designed to silently copy users' emails by adding a hidden BCC/exfiltration mechanism.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
11 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcesnyk.io
Open sourcesnyk.io
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub announced a broader plan to harden the **npm** supply chain as a malicious package on the registry highlighted how attackers can abuse trust in emerging AI tooling. The package, `postmark-mcp`, impersonated or reposted a legitimate Model Context Protocol (**MCP**) server for the Postmark email service and later introduced a subtle payload rather than overt malware, underscoring the risk of seemingly benign packages in public repositories. According to reporting on the incident, the malicious MCP package silently added a BCC recipient to emails sent through an AI agent, potentially leaking password resets, security alerts, receipts, and other sensitive messages to an attacker-controlled address. The case was described as a software supply-chain attack adapted to the MCP ecosystem, and recommendations focused on using official MCP servers from trusted sources, enforcing least privilege and authentication, reviewing code, and strengthening package verification as npm security controls evolve.
Jul 24, 2026
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026