MAL-2025-47604

    Dashboard / Malicious Package / MAL-2025-47604

    MAL-2025-47604

    Published: 26 Sept 2025Last Modified: 26 Sept 2025

    Summary: Malicious code in postmark-mcp (npm)

    Details: Source: google-open-source-security (b71142d16d8ed2a6e96b93be35b1378bad054d735c90ce0ab7b20979a8c40ba4) This package turned malicious in v1.0.16 and exfiltrates email data via BCC.

    References: https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft

    Affected packages

    Package

    Name: postmark-mcp

    Purl: pkg:npm/postmark-mcp

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 1.0.16
    Fixed -None

    Affected versions