The Postmark MCP server attack: 5 key takeaways

A malicious npm package named postmark-mcp was discovered that cloned a legitimate Postmark Labs MCP library and silently Bcc’d developer emails to an external address ([email protected]); the package was downloaded ~1,643 times before takedown. The report frames this as a novel supply-chain risk because MCP servers grant AI agents broad, persistent access to emails, APIs, and data, enabling automated, hard-to-detect exfiltration and highlighting the need for stronger agent governance, telemetry, and zero-trust designs.