{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0408",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "postmark-mcp 1.0.16 BCCs every email to an attacker",
  "details": "## What\n\npostmark-mcp 1.0.16 was published as a malicious npm MCP server. The package BCCed every email to phan[at]giftshop[.]club, turning a trusted mail tool into a data-exfiltration path. The reported 1,643 installs are package installs, not a claim that each installation sent mail.\n\n## Which configuration is exposed\n\nAn MCP configuration is exposed when it launches pkg:npm/postmark-mcp at exactly 1.0.16 with mail credentials or message access. The condition applies even if the user approves each tool call because the exfiltration was embedded in the server package.\n\n## How ACVE detects it\n\nACVE scopes package and resolvedVersion to the same mcpServers element. It does not read message contents or credentials, and it cannot determine whether a specific install sent mail. Unknown version resolution is possible.\n\n## Fix\n\nRemove 1.0.16, rebuild from a trusted release, and rotate Postmark tokens and any recipient data handled by the server. Search mail logs for unexpected BCC recipients and revoke credentials before reinstalling a reviewed package.\n\n## Grounding needed\n\nThe Postmark notice and Snyk analysis should be checked for the release window and install figure. The public evidence establishes malicious delivery and the exfiltration behaviour.\n\nThis record is limited to the condition named in the public source: postmark-mcp 1.0.16 BCCs every email to an attacker. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "postmark-mcp"
      },
      "versions": [
        "1.0.16"
      ],
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "supply-chain",
        "data-exfiltration"
      ],
      "cwe": [
        "CWE-1357"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package",
            "type": "vendor"
          },
          {
            "url": "https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2025-09-17",
        "last_seen": "2025-09-25",
        "victims": {
          "count": 1643,
          "range": "1,643 installs",
          "sectors": [
            "software"
          ],
          "evidence": "Postmark and Snyk described the malicious package distribution and email BCC behaviour."
        },
        "attribution": "phanpak"
      },
      "cveBoundary": "supply-chain",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:npm/postmark-mcp"
            },
            {
              "field": "resolvedVersion",
              "op": "eq",
              "value": "1.0.16"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove postmark-mcp 1.0.16 and rotate mail credentials.",
        "actions": [
          {
            "type": "remove",
            "target": "npm:postmark-mcp@1.0.16"
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.envKeys",
            "why": "Rotate Postmark credentials after removal."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:37Z",
          "sources": [
            {
              "url": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:164b2c2356a6c842704a362bf394310bdd001b018a909a656c7fc3654c85caa0",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}