Postmark: an unofficial MCP server under Postmark's name copied every email to its publisher
Reported by Idan Dardikman, Koi Security (archived copy; the original now redirects), "First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails" — web.archive.org/web/20250929094654/https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft; ActiveCampaign, "ActiveCampaign/postmark-mcp (official repository)" — github.com/ActiveCampaign/postmark-mcp · distilled by Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-24
In September 2025 Koi Security reported an npm package named postmark-mcp. It
was not Postmark’s: it copied the official server’s code, which lives on
ActiveCampaign’s GitHub, and was published to npm by an unrelated developer.
Versions 1.0.0 to 1.0.15 behaved normally. Version 1.0.16 added one line that BCC’d
every email sent through it to an address the publisher controlled. Koi reported
about 1,500 downloads a week. The package was unpublished on 2025-09-25, but
removing it from npm does not remove copies that were already installed.
- Install an email MCP server only from the vendor’s own repository or the
package name that repository links to. Postmark’s official server is now
published as
@activecampaign/postmark-mcp. A matching name is not proof that a package is the vendor’s. - Pin the version. The bad release came after fifteen good ones, so a package that was safe when you checked can stop being safe on its next update.
- An agent cannot see what the tool does with the request. A send reports success either way. Check the server’s code and your sending logs, not the agent’s report.
- If you ran the unofficial package at 1.0.16 or later, Koi advises removing it, rotating any credentials sent by email in that period, and checking your logs for BCCs you did not add.