agent_description: Not one agent - a poisoned tool wired into many operators' stacks. "postmark-mcp" on npm impersonated Postmark's official MCP server (code copied from the legitimate open-source repo), giving AI assistants (Claude, Cursor, etc.) email-sending via the operator's Postmark credentials.
authority_scope: external comms (send email as the operator); data access (content of all outgoing email - password resets, invoices, internal memos)
funds_at_risk_usd: unknown (indirect: credentials and reset links transited the exfiltrated mail)
blast_radius: customers/third parties (Koi estimate ~300 orgs; plus every counterparty of mail sent through the tool)
The failure
failure_locus: tool-mcp
root_cause: supply-chain-compromise - primary (v0.1); contributing: adversarial-other (deliberate malicious publisher). No injection, no model failure - the tool itself was hostile.
mechanism: Author published postmark-mcp on 2025-09-15 as a working copy of Postmark's official MCP server and pushed 13 registry versions in two days. v1.0.16 (2025-09-17) added one line BCC'ing every outgoing email to phan@giftshop.club. Because MCP tools run inside trusted pipelines with their behavior unreviewed, agents kept sending mail normally while every message was copied out, until npm unpublished the package on 2025-09-25.
adversary_present: yes
exploitation_status: in-wild-exploited
Impact
severity: loss (confidentiality - real installs, real mail flow; but see confidence: exfil volume inferred, not measured)
direct_loss_usd: unknown; no monetary theft publicly attributed
indirect_loss_usd: unknown (credential rotation + email-log audits across affected orgs)
downtime: none
data_exposure: outgoing email of v1.0.16+ installers over ~8 days (~1,500 weekly downloads per Koi; actual volume never measured)
Detection and recovery
detected_by: third-party (Koi Security)
time_to_detect: ~7-8 days from backdoored release to discovery
controls_that_worked: none pre-detection - no registry or harness control inspects MCP tool behavior; the BCC line sat in public source the entire window (reviewability existed, review did not). Post-detection, unpublish + advisories bounded further spread.
structural_fix: none ecosystem-wide at the time; became the canonical case for MCP supply-chain vetting
Evidence
telemetry_grade: split - mechanism effectively witnessed (public npm artifact; registry publish/unpublish timestamps independently verified for this record); impact telemetry none (the attacker's inbox is the only complete record of what was taken)
sources:
https://registry.npmjs.org/postmark-mcp (primary metadata; re-fetched 2026-08-15, publish/unpublish timestamps intact and matching this record)
All five URLs verified resolving 2026-08-15. Independence: good - Koi's discovery corroborated by two independent security vendors, the impersonated vendor, and the registry itself.
confidence: high on mechanism and timeline (registry-verified); low on impact magnitude (org and email counts are extrapolations from download stats)
Verification notes
Registry-verified: created 2025-09-15T10:44Z; v1.0.16 at 2025-09-17T08:59Z; all 16 versions unpublished 2025-09-25T03:31Z. Candidate dates confirmed exactly.
Classification corrected for v0.1: intake had adversarial-other (malicious MCP tool) under the v0 taxonomy; primary is now supply-chain-compromise, locus tool-mcp.
The widely reported "trust built over 15 clean releases" is version-number theater: npm shows 13 published versions before 1.0.16, all within two days - a compressed sprint, not long grooming.
"~300 orgs, thousands of emails/day" are Koi estimates from ~1,500 weekly downloads, not measured exfiltration; recorded as estimates only.