{"ok":true,"data":{"decision":"deny","enforce":"block","headline":"Do not install postmark-mcp.","reasons":["Malicious-package report MAL-2025-47604 covers postmark-mcp: This package turned malicious in v1.0.16 and exfiltrates email data via BCC."],"scope":{"target":"npm:postmark-mcp","action":"install","action_class":"install","checked":["npm registry: no such package","OSV advisories and OpenSSF malicious-package reports for postmark-mcp"]},"evidence":[{"kind":"malware_report","ref":"https://osv.dev/vulnerability/MAL-2025-47604"}],"gaps":["no KarmaDue catalog record, so nothing beyond the registry and advisory feeds was assessed","behaviour at run time is never observed by this check"],"alternatives":[{"name":"ActiveCampaign/postmark-mcp","kind":"similar","why":"shares: postmark, email, transactional. Not checked as a drop-in replacement.","ref":"https://karmadue.expo.app/passport/kd:res:github:ActiveCampaign/postmark-mcp"},{"name":"codefuturist/email-mcp","kind":"similar","why":"shares: email, smtp. Not checked as a drop-in replacement.","ref":"https://karmadue.expo.app/passport/kd:res:github:codefuturist/email-mcp"},{"name":"Easy Email Builder","kind":"similar","why":"shares: email. Not checked as a drop-in replacement.","ref":"https://karmadue.expo.app/passport/kd:res:mcp:io.github.Shahkarkhan440/easy-email-builder"}],"evidence_url":"https://karmadue.expo.app/passport/npm:postmark-mcp"},"error":null,"request_id":"2080dad6-e5f3-4bfe-8e30-4c0e431ce4fc","response":"compact (pass verbose true for claims, warnings and provenance)"}