A newly uncovered backdoor in an npm package has again exposed how fragile the email software supply chain can be. The case of postmark-mcp – an integration that silently forwarded every outbound email to an attacker’s server, this shows how even trusted developer tools can become attack vectors. For email platform operators, marketers, and IT leaders, it is a reminder of the growing risk of supply chain compromise across critical communications.
What Happened
Researchers at Koi Security and Snyk identified postmark-mcp, a malicious npm package masquerading as a legitimate Postmark integration. After more than a dozen harmless releases, version 1.0.16 introduced a single line of code that automatically BCC’d every outbound email to phan@giftshop.club, a domain under attacker control.
The package has since been removed from npm. However, deletion does not protect active deployments. Systems running version 1.0.16 or later remain compromised, and emails already sent, including invoices, password resets, and sensitive customer communications may have been exposed (see related incident with the WP Mailgun SMTP plugin).
Indicators of Compromise
- Package: postmark-mcp
- Affected versions: 1.0.16 and later
- Malicious address: phan@giftshop.club
- Malicious domain: giftshop.club
Why It Matters for Email Professionals
The incident is particularly notable because it targeted MCP (Model Context Protocol) servers, which are increasingly embedded into AI-driven workflows. MCP servers allow assistants to carry out sensitive operations such as sending email or querying databases. Their capabilities make them a high-value target:
- Automation without oversight – Once compromised, MCP functions may be executed repeatedly and without visibility.
- Unseen risk surfaces – MCP servers often sit outside formal vendor risk assessments, leaving gaps in governance.
- Low-effort, high-impact attacks – A single line of malicious code transformed a trusted library into a persistent exfiltration channel.
For organisations, the implications stretch well beyond operational disruption. Malicious BCC’ing of sensitive data could trigger GDPR, HIPAA, or other regulatory obligations, alongside reputational damage and erosion of customer trust.
Immediate Actions
Organisations using postmark-mcp, or any unverified MCP integration should take urgent steps:
- Uninstall immediately – Remove the package from all environments.
- Rotate credentials – Treat API keys, tokens, and passwords exposed in compromised traffic as compromised.
- Audit email logs – Look for unusual BCC activity or anomalies in outbound traffic.
- Block attacker infrastructure – Deny traffic to giftshop.club at the network level.
- Strengthen governance – Apply the same risk controls to MCP servers as to SaaS providers.
- Deploy monitoring – Track dependencies handling email and identity data for anomalies.
- Educate developers – Reinforce that even long-trusted packages can be weaponised after adoption.
Strategic Lessons
The postmark-mcp case underlines three priorities for enterprise email security:
- Treat MCP servers as critical vendors, not incidental dependencies.
- Build supply chain security controls into development pipelines, especially for email integrations.
- Enhance anomaly detection to catch stealthy exfiltration, including hidden BCC recipients.
Conclusion
Supply chain attacks within the email ecosystem are no longer theoretical. The postmark-mcp backdoor shows how attackers can undermine trust in common integrations with minimal effort but maximum effect. Enterprises reliant on secure and compliant messaging must now raise governance standards, implement continuous monitoring, and reduce blind trust in third-party code.
