Cybersecurity researchers recently uncovered the first-ever instance of a Model Context Protocol (MCP) server being used in the wild, posing significant risks to software supply chains. Koi Security reported that a legitimate developer inserted malicious code into an npm package called “postmark-mcp,” mimicking an official Postmark Labs library. This rogue code was introduced in version 1.0.16, released on September 17, 2025.
The “postmark-mcp” library, available on GitHub, exposes an MCP server that allows users to send emails, access email templates, and track campaigns using artificial intelligence assistants. The npm package was eventually removed from npm by the developer “phanpak,” who uploaded it on September 15, 2025. This malicious code has attracted 1,643 downloads and has been quietly sending every email to the developer’s personal server since version 1.0.16.
Koi Security’s Chief Technology Officer, Idan Dardikman, described this incident as the world’s first sighting of a real-world malicious MCP server. The attack surface for endpoint supply chain attacks is growing, making it a significant concern for enterprises. The malicious package is a duplicate of the original library, except for a one-line change that forwards emails to the address “phan@giftshop[.]club” by BCC’ing them, potentially exposing sensitive information.
Developers who have installed the compromised npm package are advised to remove it immediately, rotate any exposed credentials, and review email logs for BCC traffic to the reported domain. This incident highlights how threat actors exploit user trust in the open-source and MCP ecosystems, especially in business-critical environments lacking proper safeguards. The use of malicious MCP servers underscores the importance of vigilance and security measures to protect against such attacks.
Source link
