{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/postmark-mcp-malicious-npm-2025/",
 "asOf": "2026-09-26",
 "id": "postmark-mcp-malicious-npm-2025",
 "date": "2025-09-25",
 "datePrecision": "day",
 "title": "Malicious postmark-mcp npm package quietly copied every sent email to an outside address",
 "lane": "attack",
 "kind": "incident",
 "summary": "A package impersonating a Postmark email MCP server was published to npm and, after 15 clean versions, version 1.0.16 (2025-09-17) added code that blind-copied all emails sent through it to the publisher. Postmark stated it had never published an MCP server on npm; Koi Security found it, and the package was deleted after about 1,643 downloads.",
 "whyItMatters": "Koi Security, which found it, called it the first malicious MCP server seen in the wild, showing that MCP packages are already a live supply-chain target.",
 "actors": [
  "koi-security",
  "postmark"
 ],
 "topics": [
  "agent-supply-chain",
  "tool-and-mcp-security",
  "data-exfiltration"
 ],
 "atlas": [
  "supply-chain",
  "tools"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package",
   "publisher": "Postmark",
   "title": "Security Alert: Malicious 'postmark-mcp' npm Package Impersonating Postmark",
   "date": "2025-09-25",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html",
   "publisher": "The Hacker News",
   "title": "First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package",
   "date": "2025-09-29",
   "type": "secondary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Malicious behavior began in version 1.0.16, released 2025-09-17.",
   "locator": "The Hacker News article body"
  },
  {
   "fact": "The package had 1,643 downloads before removal.",
   "locator": "The Hacker News article body"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "malicious-agent-extensions",
  "tool-poisoning"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}