Case postmark-mcp-backdoorAI supply chainSep 25, 2025Worldwide

First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker

Koi Security found a lookalike postmark-mcp package whose v1.0.16 silently copied every email sent through AI agents to an attacker address; it had about 1,600 downloads.

HighAttack on AIStatus: ContainedVerified case file

Open in the interactive map Cite this case

Reported: Sep 25, 2025
Location: Worldwide
Target: postmark-mcp users
Severity: High
Triggered by: npm publisher 'phanpak' (identity unknown)
Actor type: Criminal
Reported loss: None reported
CVE: None

What happened

Koi Security found a lookalike postmark-mcp package whose v1.0.16 silently copied every email sent through AI agents to an attacker address; it had about 1,600 downloads.

Impact: An estimated 300 organisations exposed; thousands of emails a day including password resets and invoices silently copied to the attacker's server

Who triggered it

Actor: npm publisher 'phanpak' (identity unknown)

Attribution: Identified by Koi Security; package tied to npm account phanpak, which maintained 31 other packages; account later deleted

Motive: Covert harvesting of email contents (invoices, password resets, internal communications)

How it happened

Attack vector: Trusted npm package postmark-mcp, a copy of Postmark's official MCP server, updated in v1.0.16 with a one-line BCC to phan@giftshop.club on every outbound email

Root cause: AI agents installed unvetted community MCP servers with full email-sending trust; a single maintainer could push a backdoored update with no review

Timeline

Sep 17, 2025Version 1.0.16 of postmark-mcp published with the hidden BCC line
Sep 25, 2025Koi Security discloses the backdoor; package has about 1,500 weekly downloads
Sep 26, 2025Developer removes the package from npm without responding to Koi

Response

Package deleted from npm by the publisher; Koi, Snyk and Qualys advised uninstalling v1.0.16+, rotating credentials and auditing outbound mail

Current status: Contained

Sources (open in a new tab)

The Hacker News thehackernews.com
Snyk snyk.io
Qualys threatprotect.qualys.com

Cite this case

First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker. AI Threat Watch, case postmark-mcp-backdoor, Sep 25, 2025. https://aithreat.io/cases/postmark-mcp-backdoor/

Permanent link: https://aithreat.io/cases/postmark-mcp-backdoor/