# First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails | Koi Blog

<https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft>

- Host: [koi.security](https://links.thingelstad.xyz/hosts/koi.security/)
- Saved: September 29, 2025 (2025-09-30T01:27:22Z)
- Record: https://links.thingelstad.xyz/links/993c9f9a8db3/
- JSON: https://links.thingelstad.xyz/links/993c9f9a8db3.json

## What Jamie wrote

A bad actor takes an open source MCP server, alters it with one line of code to exfiltrate data from the requests, and publishes it under a close enough name. In no time at all a bunch of people have adopted it and are using it with this exfiltration embedded inside it. This isn't a new attack vector. Open source supply chain attacks have existed for a while. Mostly just a caution that this is a easily exploited pattern.

## Facts

- Kind: [Page](https://links.thingelstad.xyz/kinds/page/)

## Appears in

- [WT329: Weekly Thing 329 / Another Thing](https://weekly.thingelstad.com/archive/329/), Notable

## Saved the same week

- [Rio Terminal](https://links.thingelstad.xyz/links/f17bc9078709/) (rioterm.com, September 29, 2025)
- [vb.lk: vibe link](https://links.thingelstad.xyz/links/2f2f9bf71bd0/) (vb.lk, September 29, 2025)
- [Redis is fast - I'll cache in Postgres | Dizzy zone](https://links.thingelstad.xyz/links/f6cec7852b5b/) (dizzy.zone, September 29, 2025)
- [Messenger](https://links.thingelstad.xyz/links/3b97d24c7cad/) (messenger.abeto.co, September 29, 2025)
- [tangled · tightly-knit social coding](https://links.thingelstad.xyz/links/2cb2db18e765/) (tangled.org, September 29, 2025)

## Elsewhere

- Wayback Machine: https://web.archive.org/web/*/https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft