postmark

No clear malware behavior is evident. The principal security concern is that credentials are sent to any endpoint supplied via --endpoint, including potentially unencrypted HTTP destinations. Restrict the endpoint to the trusted Postmark API or otherwise ensure it is trusted before using stored credentials.