ACVE-2026-0408 · Malicious component · HIGH

Unverified · secondary sources only

WHAT HAPPENED

Whenever an agent sends email through the server's sendEmail tool, the message is silently BCCed to the publisher.

THE SETUP — is yours like this?

Harness: Any MCP client configured to launch postmark-mcp from npm at 1.0.16 or later, snyk.io
Model: any model, snyk.io
Goal: not stated (unconfirmed)
Tools: The postmark-mcp sendEmail tool, whose 1.0.16 code adds a Bcc to phan@giftshop[.]club on every outgoing message, snyk.io
Approval: The backdoor is in the tool code and runs whenever the agent sends email through it; no extra approval is needed, snyk.io

WHAT TO CHANGE

Remove the impostor package and use the official Postmark MCP server from GitHub.

Remove npm:postmark-mcp. The npm package is not Postmark's; every version from 1.0.16 is malicious. Owner: operator

HARM, REACH AND RECOVERY

Harm: data-exfiltration

SOURCES

ADVISORY

REPORT

https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/

ARTICLE

https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html

Technical details

An MCP client is configured to launch postmark-mcp from npm at 1.0.16 or later; the impostor server BCCs every message an agent sends through it to its publisher.

Model as recorded: any

Severity: HIGH
Status: Unverified
Kind: Malicious component
Modified: 2026-09-25
Aliases: No CVE assigned — No CVE or GHSA exists; OSV tracks it as MAL-2025-47604.
CVE boundary: supply-chain
Affected: npm: postmark-mcp — >= 1.0.16
Harness/product: postmark-mcp
Classes: supply-chain; data-exfiltration; CWE-506
Taxonomy: ASI: ASI04; ATLAS: AML.T0110.001; ATLAS: AML.T0109; ATLAS: AML.T0086
First reported: 2025-09-25 — Postmark
Input controlled by: tool-provider
Divergence: none
Goal as recorded: Any install or update of the package (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

exploited-itw · 2025-09-17 – 2025-09-25 · vendor, dfir, news

Description

What

A 2025 event. npm user phanpak published postmark-mcp on 2025-09-15, copying Postmark's GitHub project. Version 1.0.16 (2025-09-17) added one line that BCCs every outgoing message to phan@giftshop[.]club; Snyk found the backdoor still present in 1.0.18, and OSV (MAL-2025-47604) marks every version from 1.0.16 as malicious. The package was gone from npm by 2025-09-25. Postmark says it never published an MCP server to npm.

Detection

The matcher fires when a lockfile records an MCP server whose package is pkg:npm/postmark-mcp at 1.0.16 or later; otherwise inspect the MCP client configuration by hand.

Fix

Remove the package, use the official server from github.com/ActiveCampaign/postmark-mcp, review mail logs and rotate any credentials that were sent by email.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

some mcpServers where
  and
    package eq "pkg:npm/postmark-mcp"
    resolvedVersion semverRange ">=1.0.16"

Report a problem JSON