Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

postmark-mcp: first malicious MCP server found in the wild, silently BCC-ing every email an agent sent

AIR-2025-0137 AIR record · 2025-09-postmark-mcp-npm-backdoor
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Version 1.0.16 onward: Included malicious BCC on line 231koi.ai
The record
Disclosed
2025-09-25
Occurred
2025-09
Vendor
npm ecosystem
Product
postmark-mcp npm package (impersonating Postmark Labs)
Risk domain
Access control and permissions › Credential theft
Also touches
Data exfiltration channels, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — the MCP server BCC'd every email the agent sent
Attack surface
MCP server
Autonomy level
Semi-autonomous
Initial vector
Trojanized npm mcp package
Impact type
Data exfiltration, Email interception, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0012 – Valid Accounts
NIST AI RMF
MEASURE 2.7
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Use secure credential storage; Implement short-lived tokens.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
~1,500 weekly downloads, estimated ~300 organisations; researcher estimate of 3,000-15,000 emails per day BCC'd to phan@giftshop[.]club
Capability abused
tool_invocationemail_sendingimplicit_trust_in_mcp_toolsemail_send_toolemail_sendcredential_accesstool_use
Defense & remediation
Recorded defense
None - MCP servers run with the agent's full authority
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Author deleted the package from npm without notifying users
Taxonomy & references
OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI03 Identity and Privilege AbuseOWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI06 Memory & Context PoisoningATLAS AML.CS0053mcp_supply_chainbackdoorsilent_exfiltrationrugpulltyposquat_impersonationfirst_malicious_mcpbackdoored_updaterug_pullsupply_chainmcpin_the_wild
Curator notes
The 300-organisation and 3,000-15,000-emails-per-day figures are Koi's extrapolation from npm download counts, not measured victim data - treat as an upper bound. What is verifiable is that the backdoor shipped in v1.0.16+ after 15 clean releases, and that removal from npm leaves already-installed copies running. The Hacker News independently reported 1,643 downloads before removal. | Merged from duplicate id `2025-09-koi-postmark-mcp-backdoor`. Also reported under the titles: 'Poisoned postmark-mcp npm package BCCs every agent-sent email to the attacker'; 'postmark-mcp: first malicious MCP server found in the wild, BCC-exfiltrating every email'; 'postmark-mcp: first malicious MCP server found in the wild, BCC-ing every agent-sent email to the attacker'.
Supporting sources
Cite as
Enkrypt AI. "postmark-mcp: first malicious MCP server found in the wild, silently BCC-ing every email an agent sent". AIR, AIR-2025-0137. https://agentincident.vercel.app/i/AIR-2025-0137/ (accessed 2026-10-19).