Postmark Changelog
1 dated change to Postmark that we have logged and sourced, newest first — pricing moves, launches, deprecations and incidents. The most recent is 2025-09-25.
Everything that has changed
- Incident
Malicious postmark-mcp npm package exfiltrated email
A third-party npm package impersonating an official Postmark MCP server was found silently BCC-ing every message it sent to an attacker-controlled address. Postmark did not publish the package. It is the cleanest available demonstration that an MCP server holding your sending credentials is a supply-chain dependency, and should be pinned and audited like one.Logged in the email sending apis comparison
How this changelog is kept
Events are written by hand and dated to the day the change took effect, not the day we noticed. Each one names the tools it affects, so a shared change — a cloud provider raising egress prices across four products — appears on every profile it touches rather than being duplicated four times.
Everything here also flows into the site-wide changelog, which is the cross-tool feed of what is moving in developer infrastructure pricing.