First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package

Cybersecurity researchers have identified what is described as the first-ever malicious MCP server found in the wild, tied to a rogue npm package called postmark-mcp. According to Koi Security, a legitimate-looking developer slipped in this code, copying the official Postmark Labs library and releasing it as version 1.0.16 on 17 September 2025. The package, deleted from npm by the developer phanpak on 15 September 2025, was downloaded 1,643 times.

The manipulated library exposes an MCP server that enables users to send emails, access templates, and track campaigns, but a one-line change in version 1.0.16 forwards every email to the attacker’s address via BCC to phan@giftshop[.]club, potentially exposing sensitive communications. The backdoor is described as simple yet effective, highlighting how trust in open-source ecosystems can be abused and emphasising the need to audit such dependencies in enterprise workflows.