Incident: An email MCP server that copied everything

Module 4 · Incident file · About 30 minutes

What happened

In September 2025 Koi Security reported what The Hacker News called "the first-ever instance of a malicious Model Context Protocol (MCP) server spotted in the wild" (Ravie Lakshmanan, The Hacker News, 29 September 2025). The npm package postmark-mcp let AI assistants send email through Postmark, an email delivery service. According to Koi, it "copied an official Postmark Labs library of the same name".

CSO Online reported Koi's account: "For fifteen versions prior, postmark-mcp functioned as a legitimate tool" (Shweta Sharma, CSO Online, 26 September 2025). Version 1.0.16, released on 17 September 2025, added what The Hacker News described as "a one-line change" that forwarded every email sent through the server to an outside address by blind copy. Koi's risk engine flagged the new behaviour in 1.0.16. When Koi's researchers contacted the publisher they got no reply; the package was removed from npm "even before they could report it".

The reported cost is an estimate, not a count. The Hacker News gives 1,643 downloads in total; CSO gives about 1,500 a week. Koi's Idan Dardikman made a "conservative" guess of 3,000 to 15,000 emails per organisation per day across about 500 organisations. Postmark said: "We didn't develop, authorize, or have any involvement with the 'postmark-mcp' npm package." The advice was to remove the package, rotate credentials that may have been sent by email, and check email logs for blind copies to the reported domain.