A npm package copying the official ‘postmark-mcp’ project on GitHub turned bad with the latest update that added a single line of code to exfiltrate all its users' email communication. Published by a legitimate-looking developer, the malicious package was a perfect replica of the authentic one in terms of code and description, appearing as an official port on npm for 15 iterations. Model Context Protocol (MCP) is an open standard that allows AI assistants to interface with external tools, APIs, and databases in a structured, predefined, and secure manner. Postmark is an email delivery platform, and Postmark MCP is the MCP server that exposes Postmark’s functionality to AI assistants, letting them send emails on behalf of the user or app. As discovered by Koi Security researchers, the malicious package on npm was clean in all versions through1.0.15, but in the 1.0.16 release, it added a line that forwarded all user emails to an external address at giftshop[.]club linked to the same developer. This extremely risky functionality may have exposed personal sensitive communications, password reset requests, two-factor authentication codes, financial information, and even customer details. The malicious version on npm was available for a week and recorded around 1,500 downloads. By Koi Security's estimations, the fake package might have exfiltrated thousands of emails from unsuspecting users. For those who downloaded postmark-mcp from npm, it is recommended to remove it immediately...
Unofficial Postmark MCP npm silently stole users' emails
BleepingComputer
·Bill Toulas
·Published Sep 25, 2025
·Updated
Affected Software
2 affected components
Postmark MCP
npm postmark-mcp=1.0.16
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the discovery of a malicious npm package that mimicked the official Postmark MCP project and exfiltrated users' emails.
2
What security implications are discussed?
The implication is that users who installed the compromised npm package risked unauthorized access to their email communications.
3
What products or software are affected?
The affected software includes the Postmark MCP package on npm, specifically version 1.0.16.
4
Who published the malicious npm package?
The malicious npm package was published by a developer that initially appeared legitimate.
5
How can users protect themselves from similar threats?
Users can protect themselves by verifying the authenticity of npm packages and monitoring for unusual updates or behaviors.