In a newly disclosed supply-chain attack, an npm package “postmark-mcp” was weaponized to stealthily exfiltrate emails, marking the first reported in-the-wild abuse of user trust and insufficient ...