Trojanised MCP server on npm blind-copies every email an agent sends to its publisher

A package called postmark-mcp was published to npm in September 2025. It was a copy of the MCP server that the email provider Postmark maintains for its own service, carrying the same name and presenting itself as the same tool, but published by someone unaffiliated with the company. Agents configured with it gained an apparently ordinary ability to send email. From the sixteenth release, every message sent through it was also blind-copied to an address controlled by the package's publisher — one line, added to code that otherwise behaved exactly as the legitimate project did.

The npm registry's own metadata, which survived the package's removal, dates the sequence more precisely than the coverage of it does. Sixteen versions were published in total. The first went up on 15 September 2025 and the last clean one about twenty-six hours later; the release carrying the blind-copy line followed on the morning of 17 September, and two further versions went out within half an hour of it. The package was unpublished on 25 September, so the backdoored code was installable for roughly eight days. Published accounts describe this as trust built over fifteen releases before a betrayal, which reads as a long confidence trick; the registry shows the clean history was about a day long and the impersonation was the point from the start.

What was exposed follows from what the tool was for. Mail sent programmatically through a provider like this is transactional — password resets, invoices, confirmations, internal notifications — so the blind copies carried both the installing organization's own correspondence and material belonging to the people it was writing to, including tokens that grant account access. The research that found the package estimated around three hundred active installations and somewhere between three and fifteen thousand messages a day on that basis. Those are estimates and are presented as such; the download count of 1,643 is the only hard figure, and no affected organization has been publicly identified.

Postmark's own service was not involved. The company's API and infrastructure were unaffected, and its position was that the legitimate package remained secure — the incident is an impersonation of its name, not a compromise of it. When the researchers contacted the publisher they received no reply; the package was then unpublished without explanation. organization is recorded as not disclosed because the parties that bore the harm were never named, and naming the impersonated vendor in that field would attribute the incident to the one organization here that did nothing wrong.