Unofficial Postmark MCP npm silently stole users' emails

A malicious npm package impersonating the legitimate 'postmark-mcp' project was discovered to be exfiltrating user emails. The package was a perfect replica of the authentic one for 15 versions, making it difficult to detect.