Unofficial Postmark MCP npm silently stole users' emails

*Executive summary:* A malicious npm package that imitated the official postmark-mcp added a line in version 1.0.16 that forwarded BCC copies of all processed emails to an attacker-controlled domain (giftshop.club), potentially exposing sensitive communications (password resets, 2FA codes, financial/customer data); the fake package was available for about a week, logged ~1,500 downloads, and was later removed after disclosure.