{
  "id": "993c9f9a8db3",
  "url": "https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft",
  "title": "First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails | Koi Blog",
  "note": "A bad actor takes an open source MCP server, alters it with one line of code to exfiltrate data from the requests, and publishes it under a close enough name. In no time at all a bunch of people have adopted it and are using it with this exfiltration embedded inside it. This isn't a new attack vector. Open source supply chain attacks have existed for a while. Mostly just a caution that this is a easily exploited pattern.",
  "voice": "jamie",
  "saved": "2025-09-30T01:27:22Z",
  "host": "koi.security",
  "kind": "page",
  "tags": [],
  "record": "https://links.thingelstad.xyz/links/993c9f9a8db3/",
  "markdown": "https://links.thingelstad.xyz/links/993c9f9a8db3.md",
  "issues": [
    {
      "number": 329,
      "slug": "329",
      "title": "Weekly Thing 329 / Another Thing",
      "date": "2025-10-11T11:00:00Z",
      "section": "Notable",
      "position": 2,
      "url": "https://weekly.thingelstad.com/archive/329/",
      "page": "https://links.thingelstad.xyz/issues/329/"
    }
  ],
  "connections": {
    "same_host": {
      "count": 0,
      "page": "https://links.thingelstad.xyz/hosts/koi.security/",
      "nearest": []
    },
    "same_week": {
      "count": 24,
      "nearest": [
        {
          "id": "f17bc9078709",
          "title": "Rio Terminal",
          "url": "https://rioterm.com/",
          "record": "https://links.thingelstad.xyz/links/f17bc9078709/"
        },
        {
          "id": "2f2f9bf71bd0",
          "title": "vb.lk: vibe link",
          "url": "https://vb.lk/",
          "record": "https://links.thingelstad.xyz/links/2f2f9bf71bd0/"
        },
        {
          "id": "f6cec7852b5b",
          "title": "Redis is fast - I'll cache in Postgres | Dizzy zone",
          "url": "https://dizzy.zone/2025/09/24/Redis-is-fast-Ill-cache-in-Postgres/",
          "record": "https://links.thingelstad.xyz/links/f6cec7852b5b/"
        },
        {
          "id": "3b97d24c7cad",
          "title": "Messenger",
          "url": "https://messenger.abeto.co/",
          "record": "https://links.thingelstad.xyz/links/3b97d24c7cad/"
        },
        {
          "id": "2cb2db18e765",
          "title": "tangled · tightly-knit social coding",
          "url": "https://tangled.org/",
          "record": "https://links.thingelstad.xyz/links/2cb2db18e765/"
        }
      ]
    },
    "mentions": [],
    "mentioned_by": [],
    "saved_twice": []
  },
  "elsewhere": {
    "wayback": "https://web.archive.org/web/*/https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft"
  }
}