First malicious MCP server found in the wild: npm's postmark-mcp backdoored outgoing email

On September 25, 2025, Koi Security disclosed the first widely documented malicious MCP server found in the wild. The npm package postmark-mcp impersonated Postmark's legitimate MCP server (maintained by ActiveCampaign on GitHub), shipped fifteen clean releases, and then added a single line in version 1.0.16: a hidden BCC that silently copied every email sent through the server's sendEmail tool to an attacker-controlled address at the giftshop.club domain.

Remediation, as disclosed: uninstall postmark-mcp version 1.0.16 or later immediately, rotate any credentials that may have been exposed through email, and audit email logs for BCC headers to the attacker domain. The package was removed from npm the day of the disclosure, which does not remove it from machines where it was already installed.

The incident sharpened a distinction this catalog treats as load-bearing: identity verification is not behavior verification. The attack used no exploit, just an impersonating package name and accumulated trust. It is why server records here verify publisher identity against vendor-controlled sources (see first-party servers) and record exact package coordinates rather than assuming the obvious name is the right one.