ACVE-2026-0408

In the wild

exploited-itw · 2025-09-17 – 2025-09-25 · vendor, vendor

Description

What

postmark-mcp 1.0.16 was published as a malicious npm MCP server. The package BCCed every email to phan[at]giftshop[.]club, turning a trusted mail tool into a data-exfiltration path. The reported 1,643 installs are package installs, not a claim that each installation sent mail.

Which configuration is exposed

An MCP configuration is exposed when it launches pkg:npm/postmark-mcp at exactly 1.0.16 with mail credentials or message access. The condition applies even if the user approves each tool call because the exfiltration was embedded in the server package.

How ACVE detects it

ACVE scopes package and resolvedVersion to the same mcpServers element. It does not read message contents or credentials, and it cannot determine whether a specific install sent mail. Unknown version resolution is possible.

Fix

Remove 1.0.16, rebuild from a trusted release, and rotate Postmark tokens and any recipient data handled by the server. Search mail logs for unexpected BCC recipients and revoke credentials before reinstalling a reviewed package.

Grounding needed

The Postmark notice and Snyk analysis should be checked for the release window and install figure. The public evidence establishes malicious delivery and the exfiltration behaviour.

This record is limited to the condition named in the public source: postmark-mcp 1.0.16 BCCs every email to an attacker. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  and
    package eq "pkg:npm/postmark-mcp"
    resolvedVersion eq "1.0.16"

Fix

Remove postmark-mcp 1.0.16 and rotate mail credentials.

• Remove npm:postmark-mcp@1.0.16.
• Reconfigure mcpServers.envKeys. Rotate Postmark credentials after removal.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.