Mantine DataTable source repo compromised; owner account suspended

GitHub Discussion #813 for Mantine DataTable is a public disclosure of an open-source supply-chain security incident. The announcement was posted by Irinel-Ramona, wife of maintainer Ionut, because Ionut's GitHub account was suspended and he could not notify the community or access the repository himself. Following the incident, an attacker used the github-actions bot to push unauthorized commits to Mantine DataTable and several other repositories. The commit messages were disguised as routine dependency updates — "chore: update dependencies [skip ci]" — but in reality injected payload runners such as `.github/setup.js` and embedded trigger points inside multiple developer tooling configuration files. Affected paths include `.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/setup.mdc`, `.vscode/tasks.json`, and a hijacked `package.json` test script. This means that anyone who cloned or pulled the source code recently could trigger the malicious payload simply by opening the project in VS Code, Cursor, Claude Code, or Gemini, or by running `npm test`. The announcement explicitly notes that the published npm packages `mantine-datatable` and `mantine-contextmenu` were NOT injected with malicious versions; users who install via npm are unaffected — the primary risk is limited to developers working directly with the source repository. A subsequent update on June 6 corrected the initial speculation about the attack's origin: the post had originally suggested a link to the May 2026 TeamPCP incident involving GitHub's internal repositories, but commenters noted that incident was more likely confined to GitHub's own repositories. The update revised the assessment to say evidence points more strongly toward stolen credentials, with the TanStack supply-chain incident as a possible candidate. The announcement also notes that researchers are tracking this worm as "Miasma," belonging to the "Shai-Hulud" family, and that SafeDep and others have analyzed the repository's commits and concluded the payload matches Miasma. For developers, the key takeaway from this incident is not "stop using Mantine DataTable," but rather: avoid opening recently cloned suspicious source code, delete the relevant config files and `.github/setup.js`, audit any forks, and be aware that AI coding assistants and editor automation configs have become a new attack surface for supply-chain attacks.