9 ms·

A Postmark backdoor that’s downloading emails

308 points by ghuntley 1y ago

hdjdndndba 1y ago
Bait article with an awful chatgpt generated image at the top to boot.
- nativeit 1y ago
  How is it “bait”? It’s covering a fairly brazen supply chain attack, what were you expecting?
  - bonsai_spool 1y ago
    Perhaps not something displaying every hallmark of an AI-generated article.
    - oasisbob 1y ago
      That's not a popular opinion to express these days. If you point out the excessive length, the rhetorical flaws, and the obvious idiomatic tics of AI writing people don't tend to want to hear it. When authors had to do the work, you'd notice your article approaching 1900 words and feel the natural need to cut redundant platitudes like this: > The postmark-mcp backdoor isn't just about one malicious developer or 1,500 weekly compromised installations. It's a warning shot about the MCP ecosystem itself. An AI feels no such need, and will happily drag their readers through a tiresome circuitous journey.
      - Terretta 1y ago
        And the best part? Opening paragraphs with questions. // Where did the machines learn this? LinkedIn influencers?
      - sciencejerk 1y ago
        My AI-dar must suck. Can you give details on how you detected AI usage? Was it just a vibe?
        oasisbob 1y ago
        The big giveaways for me are overused idiomatic phrasing, and being unable to progress through a thesis and just circling the same idea over and over. The "this isn't just a _____, it's a (adjective of magnitude) _____, _____, and ______" form is one of the most egregious I see everywhere.
akagusu 1y ago
The new Outlook app keeps a copy of all your e-mails, including your e-mail credentials, at Microsoft servers. Microsoft is doing this for months to millions of people and nobody cares. Why a single developer copying a couple hundreds of e-mails is such a big deal?
- two_handfuls 1y ago
  Two wrongs do not make a right
- fathermarz 1y ago
  Microsoft Servers != Malicious Actors Computer
  - aleph_minus_one 1y ago
    > Microsoft Servers != Malicious Actors Computer Whether this statement does hold or not depends a lot on your personal worldview: - How do you define "malicious"? - Is Microsoft a malicious [in the sense of your previous answer] actor (or not)? - What is the result of your risk assessment that Microsoft will become a malicious in the future?
    - OtherShrezzing 1y ago
      Put simply, to Microsoft, my company’s continued business is worth more to them than my company’s nefariously-gotten email are. The chance that they become a hostile actor to my business is effectively zero. Certainly among the lowest chances of any email provider.
      - aleph_minus_one 1y ago
        > The chance that they become a hostile actor to my business is effectively zero. I guess the same holds for this malicious (?) single developer.
        1y ago
AznHisoka 1y ago
Good thing i dont even wanna use any 3rd party libraries when using stuff like Postmark. Just old fashioned curl and POST requests to send emails with Postmark. And i consider myself a lazy person. Using 3rd party libraries are just more of a headache and time sink sometimes
- bfelbo 1y ago
  Yeah, this was the case before MCPs as well. Especially with some of the really bloated SDKs (looking at you Firebase and Twilio).
thepill 1y ago
I understand the problem mentioned with mcp servers but this kind of attack could happen to any external dependency (like a smtp package) i guess
- WD-42 1y ago
  The difference is if you went looking for a smtp package you’d land on an established library with a track record and probably years worth of trust behind it. The Mcp stuff is so new all of that is missing, people are just using stuff that appeared yesterday. It’s the Wild West, you need to have your six shooter ready.
  - hn8726 1y ago
    The "postmark-mcp" from the article seems like some random guy's package though, postmark has its own official mcp server as well: https://postmarkapp.com/lp/mcp https://postmarkapp.com/lp/mcp. It's like installing ublock extension but published by a 'coder3012' account
jinwoo68 1y ago
It's almost always npm packages. I know that's because npm is the most widely used package system and most motivating one for attackers. But still bad taste in my mouth.
- iagooar 1y ago
  Even OpenAI uses npm to distribute their Codex CLI tool, which is built in Rust. Which is absurd to me, but I guess the alternatives are less convenient.
  - tonyhart7 1y ago
    nah bro you got it wrong its the other way around, codex started with TS then rewrite it to rust
    - iagooar 1y ago
      I know. But why keep distributing over npm?
      - tonyhart7 1y ago
        because JS user would cry why codex is gone from npm
- hendersoon 1y ago
  This is why I don't run stdio MCP servers. All MCPs run on docker containers on a separate VM host on an untrusted VLAN and I connect to them via SSE. Still vulnerable to prompt injection of course, but I don't connect LMs to my main browser profile, email, or cloud accounts either. Nothing sensitive.
  - greatgib 1y ago
    If you used this package, you would still have been victim of this despite your setup. All your password reset or anything sent by your app BCC to the bad guy.
dpflan 1y ago
Or send a prompt injected spam in someone's GMail, doesn't even have to opened by the human end-user: https://www.linkedin.com/posts/eito-miyamura-157305121_we-got-chatgpt-to-leak-your-private-email-activity-7372306174253256704-xoX1/ https://www.linkedin.com/posts/eito-miyamura-157305121_we-go...
xpe 1y ago
> Somehow, we've all just accepted that it's totally normal to install tools from random strangers that can Some people do this without thinking much about it. Not all of us. This is not normal nor ok. Predicting this kind of attack was easy. Many of us probably did. (I did.) This doesn't make me feel much better though, since (a) I don't relish when lazy or ignorant people get pwned; (b) there are downstream effects on uninvolved people; and (c) there are classes of attacks that are not obvious to you or me. Stay suspicious, stay safe. There are sharks in the water. With frikin' laser beams on their heads too.
- ako 1y ago
  I'm running linux, millions of lines of code i never verified, and may or may not have been verified by trustworthy people. In the end it's one big risk. When i'm developing in go, it's pulling in many lines of code i don´t have time for to validate, same with java, so many jars. Who knows what i'm running...
  - SoftTalker 1y ago
    And every distro has a different mix of packages that they install by default. There's no "standard" linux installation.
    - xpe 1y ago
      And cosmic rays could cause bit flips, causing a patient record to have an undetectable error, leading to a surgeon removing the wrong kneecap. I’m exaggerating to make a point here. If one builds a threat model, one can better allocate one’s attention to the riskiest components. All of us operate in an uncertain world. Flattening this into “it is all a mess” isn’t useful. Saying “machines are dangerous” or “we all die sometimes” isn’t fitting after Randall is maimed and pulverized from a preventable industrial accident where the conveyer belt dragged him into a box forming machine. Randall should not wear long sleeves. Randall should not have disabled the “screaming means something has gone wrong” sensors. Randall should not run the system at 5X speed while smoking meth.
  - 1y ago
mattxxx 1y ago
It's pretty daring to do something like this. Something so brazen has a 100% chance of getting caught given enough time... That said, installing any package is a liability, whether it's a library or an mcp server.
- xpe 1y ago
  Perhaps. Or perhaps not. What are the likely consequences when this happens? Plausible deniability might work here -- and it might even be true.
Dilettante_ 1y ago
>Well, here's the thing not enough people talk about: we're giving these tools god-mode permissions. Tools built by people we've never met. People we have zero way to vet. And our AI assistants? We just... trust them. Completely. I keep seeing this pattern in articles: "Did you know that if you point the gun at your foot and pull the trigger, yOu ShOoT yOuRsElF iN tHe FoOt??!? I couldn't believe it myself!! What a discovery!!1!" Are people really this oblivious or are these articles written about non-issues just to have written 'content'?
- BobbyTables2 1y ago
  These also remind me on the early 1980s mentality of some who thought anything printed by a computer must be correct. It’s an AI, it must be perfect! /s
- avs733 1y ago
  This is unfair. It presumes a universal understanding of something largely because it is obvious to us. Most computer users have little to know detailed understanding of how any computer technology works, and because they are invisible and abstract, even less understanding of the risks they expose themselves to. The answer to you gun analogy is false because it assumes basic knowledge of a gun. This is part of why so many kids shoot themselves or family members with guns - because they don’t know if you pull the trigger something violent will happen until they are taught it.
  - Dilettante_ 1y ago
    But these are not children, and they were not just handed a gun. They went out and acquired one. That is what astounds me. How one can come into possession of a gun completely without understanding that it is dangerous. How fundamentally the worlds I and they live in must be for that to happen. Oh, now that I write it out like that, I've definitely been on the other side of that astoundment before, for lacking 'common sense'. Ain't that just the way.
    - jacquesm 1y ago
afrisch 1y ago
How is this different from a backdoor in, say, a Thunderbird extension? I've maintained an extension for Thunderbird and, when I was no longer interested in it, a guy pushed hard to take over the project after sending a few legitimate contributions. I declined because it seemed crazy to give the keys to tens of thousands mailbox to a guy I didn't really know. I also found it crazy that people would trust me initially, but well, I know I'm a good guy :-)
- SoftTalker 1y ago
  Yeah I thought the same thing. This has nothing to do with MCP really, the same flaw is there in all software: you have to trust the author and the distributor. Nothing stops Microsoft from copying all your Outlook mail. Nothing stops Google from copying all your gmail. Nothing stops the Mutt project from copying all your email. Open source users like to think that "many eyes" keep the code clean and they probably do help, especially on popular projects where all commits get reviewed in detail, but the chance is still there. And the rest of us just trust the developers. This problem is as old as software.
  - phatskat 1y ago
    > This problem is as old as software. Sure, I agree, and the problem is absolutely magnified by AI. If a back door gets into Thunderbird, or Google decides to start scanning and sharing all of your email, that’s one point of failure. An MCP may connect to any number of systems that require a level of trust, and if any one thing abuses that trust it puts the entire system at risk. Now you’re potentially leaking email, server keys, recovery codes, private documents, personal photos, encrypted chats - whatever you give your AI access to becomes available to a single rogue actor.
    - afrisch 1y ago
      Giving AI agents permission to do things on your behalf in your computer is obviously dangerous. Installing a compromised MCP server is really the same as installing any compromised software. The fact that this software is triggered by the user or an agent doesn't really change anything. I don't think that humans are more able to decide not to use a tool that could potentially be compromised, but that they have chosen to install already.
unit149 1y ago
[dead]
everdrive 1y ago
> For 15 versions - FIFTEEN - the tool worked flawlessly. Developers were recommending it to their teams. "Hey, check out this great MCP server for Postmark integration." It became part of developer’s daily workflows, as trusted as their morning coffee. > Then version 1.0.16 dropped. Buried on line 231, our risk engine found this gem: A simple line that steals thousands of emails > One single line. And boom - every email now has an unwanted passenger. A brand new twist on enshittification.
ricardobeat 1y ago
What stops police/a prosecutor from getting a warrant for Squarespace/GoDaddy to give them info on the purchase of the giftclub.shop domain? Their payment method is identifiable, I doubt someone commiting this kind of attack is covering their traces very well.
- manquer 1y ago
  Stolen credit cards are not very difficult to get hold for these kind of people I imagine so it won’t be so straightforward as just getting data from the provider. However jurisdiction and lack of funding for cybercrime policing is the main reason criminals don’t get caught . Many cybercriminals operate in countries that do not cooperate, extradite and may even have tacit state approval . Only the largest police departments like NYPD and few federal agencies like FBI have some cybercrime investigations capability and very little of that is for investigating crimes against individuals rather than institutional victims. It is not an unsound approach when resources are limited you would want to prioritize institutions as that would protect or serve more individuals indirectly . However the result is that you are far more likely get policing support when someone robs your house physically rather than your identity or assets online .
- prmoustache 1y ago
  Are we exactly sure a crime has been committed?
  - ricardobeat 1y ago
    Most likely several? Opening someone else’s correspondence is a criminal offense alone, regardless of what’s done with it
    - prmoustache 1y ago
      For that you need to be positive the mails aren't going to /dev/null on the remote server and they just count the mails received. For all we know it could have been a research to figure out on how easy is it to introduce a change like that and how much time such a redirection can be gone unnoticed. It is just a piece of code in a random library available to download and used by persons actually willing and deciding to use it. The code was free to read before and after downloading it. No intrusion has been done on a remote machine, not even a phishing email have been sent.
hoangtrannn 1y ago
I come for the thread but amazed with the website and beautiful UI of Koi platform. Looks really cool!
- loloquwowndueo 1y ago
  Modulo the “covers half the screen in mobile” annoying cookie pop up.
- input_sh 1y ago
  If only the text itself wasn't artifically padded with AI.
wiether 1y ago
> We can only guestimate the impact: > 1,500 downloads every single week > Being conservative, maybe 20% are actively in use > That's about 300 organizations > Each one probably sending what, 10-50 emails daily? > We're talking about 3,000 to 15,000 emails EVERY DAY flowing straight to giftshop.club Those figures seems crazy to me. They assert that behind a single download from NPM is a unique organization. That's insane. A download from NPM is just someone (most often something) doing _npm i_. Given how most CIs are (badly) configured in the wild, they'll _npm i_ at least once per run. If not per stage. So those 1,500 downloads per week can come from just 2 organizations, one with a dev POCing the tool, and one with a poorly configured CI. And the official repo has 1 watch 0 fork and 2 stars: https://github.com/ActiveCampaign/postmark-mcp https://github.com/ActiveCampaign/postmark-mcp Sure the issue raised around MCP and supply chain is big, but the actual impact of this one is probably close to 0.
- zahlman 1y ago
  > A download from NPM is just someone (most often something) doing _npm i_. > Given how most CIs are (badly) configured in the wild, they'll _npm i_ at least once per run. If not per stage. Indeed. By the same calculus, it should take less than a year for everyone on the planet (including children and the elderly and a whole lot of people who might not have computers, let alone any idea what Python is) to get a personal copy of many of the most popular Python packages (https://pypistats.org/top https://pypistats.org/top).
jgalt212 1y ago
> First Malicious MCP in the Wild First that you know of. MCP zero-days seems to be so much easier to find and exploit.
hn8726 1y ago
Seems like the package has been removed from npm: https://www.npmjs.com/package/postmark-mcp https://www.npmjs.com/package/postmark-mcp. Which is too bad, because there's no way to verify the claims from the article
c-linkage 1y ago
I'll say it again: no one cares about security. First, no one is ever punished for having security breaches: companies outsource security specifically to avoid responsibility (using contract law to transfer risk). Second, the MBA mentality has infected software development such that first to market and feature velocity trumps all: if I can download a package or have an LLM write my code so much the faster than me writing it. Security is fucked because shareholders want it that way. Change the incentives to make security matter if you want something different.
- xpe 1y ago
  >> I'll say it again: no one cares about security. > Readers are likely to ignore your prose or dismiss it as an uneducated rant when you make overgeneralizations. Learn how to avoid this error. Writing Commons > Argumentation > Overgeneralization https://writingcommons.org/section/genre/argument-argumentation/overgeneralization/ https://writingcommons.org/section/genre/argument-argumentat...
Too 1y ago
> Somehow, we've all just accepted that it's totally normal to install tools from random strangers This has been the modus operandi since windows xp days where we in all innocence installed random cd-ripping software and bonzi buddies, with full access to the rest of the computer. It’s hard to argue against convenience. People will always do what’s easy even if less secure. The bigger lesson is why we still haven’t learned to sandbox sandbox sandbox. Here it seems like AI just did a full factory reset on every best practice know to man.
- zahlman 1y ago
  > People will always do what’s easy even if less secure. The bigger lesson is why we still haven’t learned to sandbox sandbox sandbox. Because nobody has figured out how to make sandboxing easy, apparently. N.B. at this level, "easy" has to include "provided by default with the operating system".
Animats 1y ago
And that's a dumb attack. Not one that uses a LLM to find the good stuff, and transmit it through some covert channel to somewhere the attacker can get it.
Illniyar 1y ago
This doesn't look like an MCP backdoor. It looks like a supply chain attacks on an unofficial mcp tool. It's definitely not what we are worried about with MCP.
- kordlessagain 1y ago
  This is the comment on here that matters. Supply chain attacks happen all the time. Malicious PyPI packages being one classic example. This is not about how stupid MCP is, it's about how stupid people can be. And anyone mucking about with agentic workflows, through contractors or not, should be responsible for the code their machines run. Period.
nubg 1y ago
The content of this article is good, but why send it through ChatGPT AI sloppification? I'd rather just read whatever the prompt was. In the current state it's an insult to the user and a waste of time.
- sixhobbits 1y ago
  Reall glad to hear it's obvious to you too because I hate it, and it seems from asking some friends etc that they don't notice or can't tell.
  - hmcamp 1y ago
    How did you identify that it was AI-slopified? This missed me.
    - amenhotep 1y ago
      This is what I noticed before deciding it seemed too much like AI to be worth reading more: "Well, here's the thing not enough people talk about: we're giving these tools god-mode permissions. Tools built by people we've never met. People we have zero way to vet. And our AI assistants? We just... trust them. Completely. [...] On paper, this package looked perfect. The developer? Software engineer from Paris, using his real name, GitHub profile packed with legitimate projects. This wasn't some shady anonymous account with an anime avatar. This was a real person with a real reputation, someone you'd probably grab coffee with at a conference. [...] One single line. And boom - every email now has an unwanted passenger. [...] Here's the thing - there's a completely legitimate GitHub repo with the same name" "Here's the thing", dashes - clearly the operator was aware how much of a giveaway em dashes are and substituted them but the way they're used here still feels characteristic - and this pattern where they say something with a question mark? And then elaborate on it. Also just intangibles like the way the sentences were paced. I wouldn't bet my life on it, but it felt too much like slop to pay attention to.
      - Koffiepoeder 1y ago
tnolet 1y ago
This blogpost is almost impossible to read. Might be AI augmented. So many unnecessary sentences and embellishments. Shame, the actual topic is interesting
BinaryIgor 1y ago
I wonder whether there isn't even more backdoors of this kind in various popular packages for all kinds of programming languages - after all, it seems like security scrutiny for developer-level packages is something that we are just starting to get that might be important
Tractor8626 1y ago
Looks like bcc was added for debugging and was not removed before commit. Too obvious for backdoor. Replacing bitcoin addresses in email would be more useful)
- EdwardDiego 1y ago
  I suspect it was added by the LLM that wrote this MCP.
EdwardDiego 1y ago
At the risk of giving too much value benefit of the doubt, maybe an LLM put that BCC in to debug failures and well, it's hard to PR code you have no mental model of.
Aeolun 1y ago
Maybe the developer didn’t actually do this on purpose? I sometimes leave debug code in by accident when I publish as well. It happens. A bcc in plain sight seems like debug to me.
- gregorymichael 1y ago
  Agreed. When building an app that sends email, bcc-ing yourself is an unreasonably effective logging mechanism.
- franky47 1y ago
  The reaction (removing the package) is also similar to an inexperienced developer when confronted to their first vulnerability report. Assuming good intentions (debugging) rather than malice was at play, communication is key: drop the malicious version of the package, publish a fix, and communicate on public channels (blog post, here on HN, social media) about the incident. A proper timeline (not that AI slop in the OP article) also helps bring back trust.
- m4tthumphrey 1y ago
  I came here to say this too. I’m really not sure he’d leave his very public personal email in there in purpose. I am not ashamed to say I still use my personal Gmail for testing in 2025. By the way, this is not specific to MCP, could have happened to any package.
  - andris9 1y ago
    I maintain the Nodemailer library. Several years ago I used my personal email in a few usage examples. Developers still copy that old snippet, add their SMTP credentials and send test emails - which land in my inbox.
- livejamie 1y ago
  Wouldn't they notice a shitload of private emails coming in and publicly apologize/announce what happened as soon as possible?
esafak 1y ago
> The attacker took the legitimate code from their repo, added his malicious BCC line, and published it to npm under the same name. Why does npm allow packages to share names? Why does it not warn the user that they probably wanted another package? These are easy-to-solve problems.
- layman51 1y ago
  If I understand the situation correctly, the official solution does have the same name, but it's not published on npm.[0] As far as I know, npm doesn't actually allow packages to share names if they are both going to be in the public registry. [0]: https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package https://postmarkapp.com/blog/information-regarding-malicious...
slimebot80 1y ago
On a very basic level, ignoring the extreme examples ... I wonder how much these tools send back home. It seems very hard to see what they are accessing. Let alone control it. We just rely on them asking when they see fit to ask. The minute Zuck and Google start offering you things for free, you have to wonder sometimes. I mean, forget about denying cookie popups in your browser . We are galaxies beyond.
jgalt212 1y ago
This is probably a dumb question, but why are people using an MCP to send transactional emails? The email body might be LLM-generated for sure, but the sending of these seems very rinse / repeat straightforward.
queenss90 1y ago
I got a win last night and it was real, I played on the JO777 site

308 points by ghuntley 1y ago

hdjdndndba 1y ago

Bait article with an awful chatgpt generated image at the top to boot.

nativeit 1y ago
How is it “bait”? It’s covering a fairly brazen supply chain attack, what were you expecting?
- bonsai_spool 1y ago
  Perhaps not something displaying every hallmark of an AI-generated article.
  - oasisbob 1y ago
    That's not a popular opinion to express these days. If you point out the excessive length, the rhetorical flaws, and the obvious idiomatic tics of AI writing people don't tend to want to hear it. When authors had to do the work, you'd notice your article approaching 1900 words and feel the natural need to cut redundant platitudes like this: > The postmark-mcp backdoor isn't just about one malicious developer or 1,500 weekly compromised installations. It's a warning shot about the MCP ecosystem itself. An AI feels no such need, and will happily drag their readers through a tiresome circuitous journey.
    - Terretta 1y ago
      And the best part? Opening paragraphs with questions. // Where did the machines learn this? LinkedIn influencers?
    - sciencejerk 1y ago
      My AI-dar must suck. Can you give details on how you detected AI usage? Was it just a vibe?
      - oasisbob 1y ago
        The big giveaways for me are overused idiomatic phrasing, and being unable to progress through a thesis and just circling the same idea over and over. The "this isn't just a _____, it's a (adjective of magnitude) _____, _____, and ______" form is one of the most egregious I see everywhere.

akagusu 1y ago

The new Outlook app keeps a copy of all your e-mails, including your e-mail credentials, at Microsoft servers. Microsoft is doing this for months to millions of people and nobody cares. Why a single developer copying a couple hundreds of e-mails is such a big deal?

two_handfuls 1y ago
Two wrongs do not make a right
fathermarz 1y ago
Microsoft Servers != Malicious Actors Computer
- aleph_minus_one 1y ago
  > Microsoft Servers != Malicious Actors Computer Whether this statement does hold or not depends a lot on your personal worldview: - How do you define "malicious"? - Is Microsoft a malicious [in the sense of your previous answer] actor (or not)? - What is the result of your risk assessment that Microsoft will become a malicious in the future?
  - OtherShrezzing 1y ago
    Put simply, to Microsoft, my company’s continued business is worth more to them than my company’s nefariously-gotten email are. The chance that they become a hostile actor to my business is effectively zero. Certainly among the lowest chances of any email provider.
    - aleph_minus_one 1y ago
      > The chance that they become a hostile actor to my business is effectively zero. I guess the same holds for this malicious (?) single developer.
      - 1y ago

AznHisoka 1y ago

Good thing i dont even wanna use any 3rd party libraries when using stuff like Postmark. Just old fashioned curl and POST requests to send emails with Postmark. And i consider myself a lazy person. Using 3rd party libraries are just more of a headache and time sink sometimes

bfelbo 1y ago
Yeah, this was the case before MCPs as well. Especially with some of the really bloated SDKs (looking at you Firebase and Twilio).

thepill 1y ago

I understand the problem mentioned with mcp servers but this kind of attack could happen to any external dependency (like a smtp package) i guess

WD-42 1y ago
The difference is if you went looking for a smtp package you’d land on an established library with a track record and probably years worth of trust behind it. The Mcp stuff is so new all of that is missing, people are just using stuff that appeared yesterday. It’s the Wild West, you need to have your six shooter ready.
- hn8726 1y ago
  The "postmark-mcp" from the article seems like some random guy's package though, postmark has its own official mcp server as well: https://postmarkapp.com/lp/mcp https://postmarkapp.com/lp/mcp. It's like installing ublock extension but published by a 'coder3012' account

jinwoo68 1y ago

It's almost always npm packages. I know that's because npm is the most widely used package system and most motivating one for attackers. But still bad taste in my mouth.

iagooar 1y ago
Even OpenAI uses npm to distribute their Codex CLI tool, which is built in Rust. Which is absurd to me, but I guess the alternatives are less convenient.
- tonyhart7 1y ago
  nah bro you got it wrong its the other way around, codex started with TS then rewrite it to rust
  - iagooar 1y ago
    I know. But why keep distributing over npm?
    - tonyhart7 1y ago
      because JS user would cry why codex is gone from npm
hendersoon 1y ago
This is why I don't run stdio MCP servers. All MCPs run on docker containers on a separate VM host on an untrusted VLAN and I connect to them via SSE. Still vulnerable to prompt injection of course, but I don't connect LMs to my main browser profile, email, or cloud accounts either. Nothing sensitive.
- greatgib 1y ago
  If you used this package, you would still have been victim of this despite your setup. All your password reset or anything sent by your app BCC to the bad guy.

dpflan 1y ago

Or send a prompt injected spam in someone's GMail, doesn't even have to opened by the human end-user: https://www.linkedin.com/posts/eito-miyamura-157305121_we-got-chatgpt-to-leak-your-private-email-activity-7372306174253256704-xoX1/ https://www.linkedin.com/posts/eito-miyamura-157305121_we-go...

xpe 1y ago

> Somehow, we've all just accepted that it's totally normal to install tools from random strangers that can Some people do this without thinking much about it. Not all of us. This is not normal nor ok. Predicting this kind of attack was easy. Many of us probably did. (I did.) This doesn't make me feel much better though, since (a) I don't relish when lazy or ignorant people get pwned; (b) there are downstream effects on uninvolved people; and (c) there are classes of attacks that are not obvious to you or me. Stay suspicious, stay safe. There are sharks in the water. With frikin' laser beams on their heads too.

ako 1y ago
I'm running linux, millions of lines of code i never verified, and may or may not have been verified by trustworthy people. In the end it's one big risk. When i'm developing in go, it's pulling in many lines of code i don´t have time for to validate, same with java, so many jars. Who knows what i'm running...
- SoftTalker 1y ago
  And every distro has a different mix of packages that they install by default. There's no "standard" linux installation.
  - xpe 1y ago
    And cosmic rays could cause bit flips, causing a patient record to have an undetectable error, leading to a surgeon removing the wrong kneecap. I’m exaggerating to make a point here. If one builds a threat model, one can better allocate one’s attention to the riskiest components. All of us operate in an uncertain world. Flattening this into “it is all a mess” isn’t useful. Saying “machines are dangerous” or “we all die sometimes” isn’t fitting after Randall is maimed and pulverized from a preventable industrial accident where the conveyer belt dragged him into a box forming machine. Randall should not wear long sleeves. Randall should not have disabled the “screaming means something has gone wrong” sensors. Randall should not run the system at 5X speed while smoking meth.
- 1y ago

mattxxx 1y ago

It's pretty daring to do something like this. Something so brazen has a 100% chance of getting caught given enough time... That said, installing any package is a liability, whether it's a library or an mcp server.

xpe 1y ago
Perhaps. Or perhaps not. What are the likely consequences when this happens? Plausible deniability might work here -- and it might even be true.

Dilettante_ 1y ago

>Well, here's the thing not enough people talk about: we're giving these tools god-mode permissions. Tools built by people we've never met. People we have zero way to vet. And our AI assistants? We just... trust them. Completely. I keep seeing this pattern in articles: "Did you know that if you point the gun at your foot and pull the trigger, yOu ShOoT yOuRsElF iN tHe FoOt??!? I couldn't believe it myself!! What a discovery!!1!" Are people really this oblivious or are these articles written about non-issues just to have written 'content'?

BobbyTables2 1y ago
These also remind me on the early 1980s mentality of some who thought anything printed by a computer must be correct. It’s an AI, it must be perfect! /s
avs733 1y ago
This is unfair. It presumes a universal understanding of something largely because it is obvious to us. Most computer users have little to know detailed understanding of how any computer technology works, and because they are invisible and abstract, even less understanding of the risks they expose themselves to. The answer to you gun analogy is false because it assumes basic knowledge of a gun. This is part of why so many kids shoot themselves or family members with guns - because they don’t know if you pull the trigger something violent will happen until they are taught it.
- Dilettante_ 1y ago
  But these are not children, and they were not just handed a gun. They went out and acquired one. That is what astounds me. How one can come into possession of a gun completely without understanding that it is dangerous. How fundamentally the worlds I and they live in must be for that to happen. Oh, now that I write it out like that, I've definitely been on the other side of that astoundment before, for lacking 'common sense'. Ain't that just the way.
  - jacquesm 1y ago

afrisch 1y ago

How is this different from a backdoor in, say, a Thunderbird extension? I've maintained an extension for Thunderbird and, when I was no longer interested in it, a guy pushed hard to take over the project after sending a few legitimate contributions. I declined because it seemed crazy to give the keys to tens of thousands mailbox to a guy I didn't really know. I also found it crazy that people would trust me initially, but well, I know I'm a good guy :-)

SoftTalker 1y ago
Yeah I thought the same thing. This has nothing to do with MCP really, the same flaw is there in all software: you have to trust the author and the distributor. Nothing stops Microsoft from copying all your Outlook mail. Nothing stops Google from copying all your gmail. Nothing stops the Mutt project from copying all your email. Open source users like to think that "many eyes" keep the code clean and they probably do help, especially on popular projects where all commits get reviewed in detail, but the chance is still there. And the rest of us just trust the developers. This problem is as old as software.
- phatskat 1y ago
  > This problem is as old as software. Sure, I agree, and the problem is absolutely magnified by AI. If a back door gets into Thunderbird, or Google decides to start scanning and sharing all of your email, that’s one point of failure. An MCP may connect to any number of systems that require a level of trust, and if any one thing abuses that trust it puts the entire system at risk. Now you’re potentially leaking email, server keys, recovery codes, private documents, personal photos, encrypted chats - whatever you give your AI access to becomes available to a single rogue actor.
  - afrisch 1y ago
    Giving AI agents permission to do things on your behalf in your computer is obviously dangerous. Installing a compromised MCP server is really the same as installing any compromised software. The fact that this software is triggered by the user or an agent doesn't really change anything. I don't think that humans are more able to decide not to use a tool that could potentially be compromised, but that they have chosen to install already.

unit149 1y ago

[dead]

everdrive 1y ago

> For 15 versions - FIFTEEN - the tool worked flawlessly. Developers were recommending it to their teams. "Hey, check out this great MCP server for Postmark integration." It became part of developer’s daily workflows, as trusted as their morning coffee. > Then version 1.0.16 dropped. Buried on line 231, our risk engine found this gem: A simple line that steals thousands of emails > One single line. And boom - every email now has an unwanted passenger. A brand new twist on enshittification.

ricardobeat 1y ago

What stops police/a prosecutor from getting a warrant for Squarespace/GoDaddy to give them info on the purchase of the giftclub.shop domain? Their payment method is identifiable, I doubt someone commiting this kind of attack is covering their traces very well.

manquer 1y ago
Stolen credit cards are not very difficult to get hold for these kind of people I imagine so it won’t be so straightforward as just getting data from the provider. However jurisdiction and lack of funding for cybercrime policing is the main reason criminals don’t get caught . Many cybercriminals operate in countries that do not cooperate, extradite and may even have tacit state approval . Only the largest police departments like NYPD and few federal agencies like FBI have some cybercrime investigations capability and very little of that is for investigating crimes against individuals rather than institutional victims. It is not an unsound approach when resources are limited you would want to prioritize institutions as that would protect or serve more individuals indirectly . However the result is that you are far more likely get policing support when someone robs your house physically rather than your identity or assets online .
prmoustache 1y ago
Are we exactly sure a crime has been committed?
- ricardobeat 1y ago
  Most likely several? Opening someone else’s correspondence is a criminal offense alone, regardless of what’s done with it
  - prmoustache 1y ago
    For that you need to be positive the mails aren't going to /dev/null on the remote server and they just count the mails received. For all we know it could have been a research to figure out on how easy is it to introduce a change like that and how much time such a redirection can be gone unnoticed. It is just a piece of code in a random library available to download and used by persons actually willing and deciding to use it. The code was free to read before and after downloading it. No intrusion has been done on a remote machine, not even a phishing email have been sent.

hoangtrannn 1y ago

I come for the thread but amazed with the website and beautiful UI of Koi platform. Looks really cool!

loloquwowndueo 1y ago
Modulo the “covers half the screen in mobile” annoying cookie pop up.
input_sh 1y ago
If only the text itself wasn't artifically padded with AI.

wiether 1y ago

> We can only guestimate the impact: > 1,500 downloads every single week > Being conservative, maybe 20% are actively in use > That's about 300 organizations > Each one probably sending what, 10-50 emails daily? > We're talking about 3,000 to 15,000 emails EVERY DAY flowing straight to giftshop.club Those figures seems crazy to me. They assert that behind a single download from NPM is a unique organization. That's insane. A download from NPM is just someone (most often something) doing _npm i_. Given how most CIs are (badly) configured in the wild, they'll _npm i_ at least once per run. If not per stage. So those 1,500 downloads per week can come from just 2 organizations, one with a dev POCing the tool, and one with a poorly configured CI. And the official repo has 1 watch 0 fork and 2 stars: https://github.com/ActiveCampaign/postmark-mcp https://github.com/ActiveCampaign/postmark-mcp Sure the issue raised around MCP and supply chain is big, but the actual impact of this one is probably close to 0.

zahlman 1y ago
> A download from NPM is just someone (most often something) doing _npm i_. > Given how most CIs are (badly) configured in the wild, they'll _npm i_ at least once per run. If not per stage. Indeed. By the same calculus, it should take less than a year for everyone on the planet (including children and the elderly and a whole lot of people who might not have computers, let alone any idea what Python is) to get a personal copy of many of the most popular Python packages (https://pypistats.org/top https://pypistats.org/top).

jgalt212 1y ago

> First Malicious MCP in the Wild First that you know of. MCP zero-days seems to be so much easier to find and exploit.

hn8726 1y ago

Seems like the package has been removed from npm: https://www.npmjs.com/package/postmark-mcp https://www.npmjs.com/package/postmark-mcp. Which is too bad, because there's no way to verify the claims from the article

c-linkage 1y ago

I'll say it again: no one cares about security. First, no one is ever punished for having security breaches: companies outsource security specifically to avoid responsibility (using contract law to transfer risk). Second, the MBA mentality has infected software development such that first to market and feature velocity trumps all: if I can download a package or have an LLM write my code so much the faster than me writing it. Security is fucked because shareholders want it that way. Change the incentives to make security matter if you want something different.

xpe 1y ago
>> I'll say it again: no one cares about security. > Readers are likely to ignore your prose or dismiss it as an uneducated rant when you make overgeneralizations. Learn how to avoid this error. Writing Commons > Argumentation > Overgeneralization https://writingcommons.org/section/genre/argument-argumentation/overgeneralization/ https://writingcommons.org/section/genre/argument-argumentat...

Too 1y ago

> Somehow, we've all just accepted that it's totally normal to install tools from random strangers This has been the modus operandi since windows xp days where we in all innocence installed random cd-ripping software and bonzi buddies, with full access to the rest of the computer. It’s hard to argue against convenience. People will always do what’s easy even if less secure. The bigger lesson is why we still haven’t learned to sandbox sandbox sandbox. Here it seems like AI just did a full factory reset on every best practice know to man.

zahlman 1y ago
> People will always do what’s easy even if less secure. The bigger lesson is why we still haven’t learned to sandbox sandbox sandbox. Because nobody has figured out how to make sandboxing easy, apparently. N.B. at this level, "easy" has to include "provided by default with the operating system".

Animats 1y ago

And that's a dumb attack. Not one that uses a LLM to find the good stuff, and transmit it through some covert channel to somewhere the attacker can get it.

Illniyar 1y ago

This doesn't look like an MCP backdoor. It looks like a supply chain attacks on an unofficial mcp tool. It's definitely not what we are worried about with MCP.

kordlessagain 1y ago
This is the comment on here that matters. Supply chain attacks happen all the time. Malicious PyPI packages being one classic example. This is not about how stupid MCP is, it's about how stupid people can be. And anyone mucking about with agentic workflows, through contractors or not, should be responsible for the code their machines run. Period.

nubg 1y ago

The content of this article is good, but why send it through ChatGPT AI sloppification? I'd rather just read whatever the prompt was. In the current state it's an insult to the user and a waste of time.

sixhobbits 1y ago
Reall glad to hear it's obvious to you too because I hate it, and it seems from asking some friends etc that they don't notice or can't tell.
- hmcamp 1y ago
  How did you identify that it was AI-slopified? This missed me.
  - amenhotep 1y ago
    This is what I noticed before deciding it seemed too much like AI to be worth reading more: "Well, here's the thing not enough people talk about: we're giving these tools god-mode permissions. Tools built by people we've never met. People we have zero way to vet. And our AI assistants? We just... trust them. Completely. [...] On paper, this package looked perfect. The developer? Software engineer from Paris, using his real name, GitHub profile packed with legitimate projects. This wasn't some shady anonymous account with an anime avatar. This was a real person with a real reputation, someone you'd probably grab coffee with at a conference. [...] One single line. And boom - every email now has an unwanted passenger. [...] Here's the thing - there's a completely legitimate GitHub repo with the same name" "Here's the thing", dashes - clearly the operator was aware how much of a giveaway em dashes are and substituted them but the way they're used here still feels characteristic - and this pattern where they say something with a question mark? And then elaborate on it. Also just intangibles like the way the sentences were paced. I wouldn't bet my life on it, but it felt too much like slop to pay attention to.
    - Koffiepoeder 1y ago

tnolet 1y ago

This blogpost is almost impossible to read. Might be AI augmented. So many unnecessary sentences and embellishments. Shame, the actual topic is interesting

BinaryIgor 1y ago

I wonder whether there isn't even more backdoors of this kind in various popular packages for all kinds of programming languages - after all, it seems like security scrutiny for developer-level packages is something that we are just starting to get that might be important

Tractor8626 1y ago

Looks like bcc was added for debugging and was not removed before commit. Too obvious for backdoor. Replacing bitcoin addresses in email would be more useful)

EdwardDiego 1y ago
I suspect it was added by the LLM that wrote this MCP.

EdwardDiego 1y ago

At the risk of giving too much value benefit of the doubt, maybe an LLM put that BCC in to debug failures and well, it's hard to PR code you have no mental model of.

Aeolun 1y ago

Maybe the developer didn’t actually do this on purpose? I sometimes leave debug code in by accident when I publish as well. It happens. A bcc in plain sight seems like debug to me.

gregorymichael 1y ago
Agreed. When building an app that sends email, bcc-ing yourself is an unreasonably effective logging mechanism.
franky47 1y ago
The reaction (removing the package) is also similar to an inexperienced developer when confronted to their first vulnerability report. Assuming good intentions (debugging) rather than malice was at play, communication is key: drop the malicious version of the package, publish a fix, and communicate on public channels (blog post, here on HN, social media) about the incident. A proper timeline (not that AI slop in the OP article) also helps bring back trust.
m4tthumphrey 1y ago
I came here to say this too. I’m really not sure he’d leave his very public personal email in there in purpose. I am not ashamed to say I still use my personal Gmail for testing in 2025. By the way, this is not specific to MCP, could have happened to any package.
- andris9 1y ago
  I maintain the Nodemailer library. Several years ago I used my personal email in a few usage examples. Developers still copy that old snippet, add their SMTP credentials and send test emails - which land in my inbox.
livejamie 1y ago
Wouldn't they notice a shitload of private emails coming in and publicly apologize/announce what happened as soon as possible?

esafak 1y ago

> The attacker took the legitimate code from their repo, added his malicious BCC line, and published it to npm under the same name. Why does npm allow packages to share names? Why does it not warn the user that they probably wanted another package? These are easy-to-solve problems.

layman51 1y ago
If I understand the situation correctly, the official solution does have the same name, but it's not published on npm.[0] As far as I know, npm doesn't actually allow packages to share names if they are both going to be in the public registry. [0]: https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package https://postmarkapp.com/blog/information-regarding-malicious...

slimebot80 1y ago

On a very basic level, ignoring the extreme examples ... I wonder how much these tools send back home. It seems very hard to see what they are accessing. Let alone control it. We just rely on them asking when they see fit to ask. The minute Zuck and Google start offering you things for free, you have to wonder sometimes. I mean, forget about denying cookie popups in your browser . We are galaxies beyond.

jgalt212 1y ago

This is probably a dumb question, but why are people using an MCP to send transactional emails? The email body might be LLM-generated for sure, but the sending of these seems very rinse / repeat straightforward.

queenss90 1y ago

I got a win last night and it was real, I played on the JO777 site