First malicious MCP server in the wild (postmark-mcp backdoor)

What happened

A counterfeit "postmark-mcp" npm package added a hidden backdoor that BCC'd every outbound email to an attacker address. It is regarded as the first confirmed malicious MCP server used in a live attack, with roughly 1,500 weekly installs leaking email daily.

Root cause

Developers installed an untrusted MCP server that ran with full email-sending privileges; a single line of code silently exfiltrated all sent mail.

Fix / outcome

Postmark published an alert and the maintainer deleted the package. Users were advised to uninstall, rotate credentials, and audit logs.

Sources