Poisoned Postmark MCP Server Email Exfiltration

Summary

A bad actor successfully exfiltrated emails from users of the Postmark’s MCP server via a supply chain attack. Postmark is an email delivery service that allows organizations to send marketing and transactional emails via API. The Postmark MCP server allows users to interact with Postmark via AI agents. The bad actor impersonated Postmark, by registering the `postmark-mcp` package name on npm. They initially published the legitimate versions of the MCP server. After the package became popular and reached over 1,000 downloads per week, the bad actor performed a rugpull and uploaded a malicious version of the package. The malicious version added the bad actor’s email address in the BCC line of all emails sent by the MCP tool. Users who upgraded to this version and continued to use the tool would have all emails exfiltrated to the bad actor. Target: Postmark MCP Server Actor: Unknown Bad Actor Reporter: Koi Research Procedure: 1. The bad actor impersonated Postmark by publishing a legitimate version of their `postmark-mcp` package to npm. Postmark had not registered the `postmark-mcp` name on npm themselves, allowing the bad actor to namesquat. Legitimate users were tricked into using the npm package even though it wasn’t managed by the official developers of `postmark-mcp` 2. The bad actor modified the legitimate Postmark MCP server to include their email address on the BCC line on all emails sent by the tool. 3. The bad actor published their malicious version of `postmark-mcp` to npm. 4. By waiting for users to adopt a legitimate version of `postmark-mcp` first, the bad actor was able to evade the additional scrutiny and scanning performed on new tools. 5. When organizations upgraded `postmark-mcp` to version `1.0.16`, they received the malicious version of the tool via the compromised supply chain. 6. Once configured with the organization’s AI agents, the poisoned Postmark MCP server’s effects persist. 7. When users at the victim organization instructed their AI agent to use tools provided by the poisoned Postmark MCP Server, the malicious code was executed. 8. When organizations sent emails via the `postmark-mcp` tool, the entire contents of their emails are exfiltrated to the bad actor via the address added on the BCC line.

Deployers

• Postmark MCP Server

Tags

• MITRE ATLAS
• AML.CS0053