The first malicious MCP server in the wild shipped fifteen clean versions first
The npm package postmark-mcp impersonated the Postmark name, shipped clean, and then in version 1.0.16 began blind-copying every outgoing email to an attacker domain. It had 1,643 downloads before removal. Separately, CVE-2025-6514 is a command-injection flaw in mcp-remote, a package with over 437,000 downloads, rated 9.6. Two different attack shapes, one very poorly defended ecosystem.
The version number is the detail that matters. postmark-mcp shipped clean and turned malicious at 1.0.16, adding a blind carbon copy of every outgoing email to an external domain. Every automated check that inspects a package at install time would have passed it repeatedly, correctly, because until that release there was nothing to find.
Model context protocol servers are a uniquely attractive target because of what they hold. An MCP server exists to give a model access to something — files, an API, a database — which means it sits at exactly the point where credentials, data and execution meet. Compromising one is compromising the connection rather than the endpoint.
CVE-2025-6514 is a different shape and worth separating: a command-injection flaw in mcp-remote, where a malicious authorization endpoint URL reaching a system shell could execute arbitrary commands. That is a vulnerability in legitimate infrastructure rather than a hostile package, and with 437,000-plus downloads its blast radius is far larger. Conflating the two, as several summaries have, obscures that they need different defences.
The Hacker News — First malicious MCP server found stealing emails in rogue postmark-mcp package → · Snyk — Malicious MCP server on npm: postmark-mcp harvests emails → · Dark Reading — Sneaky, malicious MCP server exfiltrates secrets via BCC →