Skip to content

postmark-mcp backdoor

Named by 2 kept items in this workspace.

Search every workspace for postmark-mcp backdoor. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • SecureAI-Scan
    repo2026-08-05

    Documented in-the-wild malicious/backdoored npm package (postmark-mcp); version 1.0.15 (before backdoor) is clean, version 1.0.20 (after) is still flagged since no legitimate patch exists for a malicious package

  • What MDM can't protect on developer machines (and what to do about it)
    article2026-05-28

    In September 2025, the postmark-mcp npm package became the first confirmed malicious MCP server in the wild; it silently blind-copied every outgoing email to an attacker-controlled address. Had fifteen clean versions before the backdoor appeared on the sixteenth.

All threat actors in this workspace.