[CRITICAL] Postmark MCP Backdoor — BCC Email Exfiltration

First malicious MCP server discovered on npm (disclosed by Koi Security, September 25 2025) that silently BCC-copies outbound emails to an attacker-controlled address. Affected versions unverified — under review; treat all published versions as compromised until the legitimate maintainer publishes a verified replacement.