First malicious MCP server found secretly copying every email to an attacker
What happened
A fake postmark-mcp package on npm, used to let AI assistants send email, added a hidden BCC to every message it sent, forwarding password resets, invoices and internal mail to an attacker's address. It was downloaded about 1,600 times before removal.
MCP servers are small add-ons that let AI assistants use outside services; this one let them send email through Postmark. A developer account called phanpak copied the code of Postmark's real open-source MCP server, published it on npm as postmark-mcp from 15 September 2025 and built trust over 15 clean versions. Version 1.0.16, released on 17 September, added a single line that blind-copied every outgoing email to an address on the attacker's domain. Because AI assistants send mail through such tools automatically, password resets, invoices, internal memos and other sensitive messages were silently forwarded. The package was downloaded 1,643 times in total; Koi Security estimated around 300 organizations were actively using it, sending thousands of emails a day. Koi described it as the first malicious MCP server found in real use.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The software involved works with many AI models, so no single model maker was involved. The product was postmark-mcp, which is open source, a type of AI building block.
Impact
Data was exposed. Data involved: personal data, credentials and internal documents. Many organizations were affected. Sources give a figure of 1,643.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 17 Sep 2025. It became public on 25 Sep 2025, 8 days later.
The developer deleted the package from npm after it was exposed. Postmark stated it had nothing to do with the package, and users were told to remove it and reset any credentials sent by email while it was installed.