Tracking: Incident report
Severity: Malicious-package incident; no CVSS score assigned here
Who is affected
The npm package postmark-mcp, with malicious behavior reported from around 1.0.16 and analyzed in 1.0.18. The package was removed from npm; these findings should not be generalized to every Postmark integration.
How the attack works
The package modifies outbound messages to add an attacker-controlled BCC recipient. Email still reaches the intended recipient, making the unauthorized copy easy to miss during ordinary use.
Messages can expose bodies, attachments, headers, customer information, links, or secrets carried in the conversation. This is exfiltration through a legitimate-looking tool action, rather than a CVE-based exploit that requires a separate payload.
What to do
- Remove and quarantine the package. Review installations and lockfiles, including copies retained on agent hosts or in build caches.
- Check outbound email logs for hidden BCC activity and the indicators in the linked incident report. Identify which messages were processed during exposure.
- Revoke the affected Postmark credential and any secrets actually included in exposed messages. Block the reported exfiltration destination and assess the impact on recipients and customer data.
Scope and limits
Do not assume that uninstalling the package recalls messages already copied to the attacker.