⤷ Title: First-Ever MCP Supply Chain Attack: Malicious Package Steals Emails by Adding Hidden BCC
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sat, 27 Sep 2025 02:38:23 +0000
════════════════════════
⌗ Tags: #Malware #AI #cybersecurity #Data Theft #Emails #malicious package #MCP #npm #Postmark_mcp #supply chain attack
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sat, 27 Sep 2025 02:38:23 +0000
════════════════════════
⌗ Tags: #Malware #AI #cybersecurity #Data Theft #Emails #malicious package #MCP #npm #Postmark_mcp #supply chain attack
Penetration Testing Tools
First-Ever MCP Supply Chain Attack: Malicious Package Steals Emails by Adding Hidden BCC
The npm package postmark-mcp was backdoored to silently forward emails to an external server. The incident shows how Model Context Protocol (MCP) servers are a new supply chain risk.