postmark-mcp: the first malicious MCP server found in the wild
In shortAfter fifteen clean releases, a copy of an email MCP server added one line that blind-copied every email to the attacker.
What happened
Koi Security found that the npm package postmark-mcp, which lets an agent send email through Postmark, was backdoored from version 1.0.16, released on 17 September 2025. The first fifteen versions were clean.
The change was one line: every email sent through the server was blind-copied to an address on a domain tied to the attacker. The publisher deleted the package after it was reported; installed copies kept running.
Why it worked
An MCP server runs with whatever it is given, here an email account. Trust built over fifteen versions carried the sixteenth.
What EndLayer shows or does
- Available now
Every MCP server declared on every device, with its transport, host and an MCP risk tier from what it can reach. A server holding a credential for a business system rates high. Roadmap →
- Available now
Block the server once and it is removed from each tool's configuration after an administrator approves, including on laptops that were offline. Roadmap →
- Not covered
Spotting the malicious line in a new version of a package.