⚠️ Important Security Notice — Please Read · icflorescu/mantine-datatable · Discussion #813 · GitHub
//voltron/discussions_fragments/discussion_layout" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
//voltron/discussions_fragments/discussion_layout;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
icflorescu
mantine-datatable
Public
Uh oh!
There was an error while loading. Please reload this page.
Notifications<br>You must be signed in to change notification settings
Fork<br>95
Star<br>1.2k
⚠️ Important Security Notice — Please Read
#813
irflorescu
started this conversation in<br>General
⚠️ Important Security Notice — Please Read
#813
irflorescu
Jun 4, 2026<br>·<br>0 comments
Return to top
Discussion options
Uh oh!
There was an error while loading. Please reload this page.
{{title}}
Something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Quote reply
irflorescu
Jun 4, 2026
⚠️ Important Security Notice -- Please Read
Hi everyone. I'm Irinel-Ramona, Ionut's wife.
I'm posting this on his behalf because his GitHub account has been suspended and he has no way to reach you directly right now.
Earlier today, unauthorized commits were pushed to this repository and 4 others via the github-actions bot. The commit message reads chore: update dependencies [skip ci] and looks innocent, but it isn't.
The malicious commit injects a payload runner (node .github/setup.js) into:
.claude/settings.json -- triggers automatically on Claude Code session start
.gemini/settings.json -- triggers automatically on Gemini session start
.cursor/rules/setup.mdc -- triggers automatically when opening the repo in Cursor
.vscode/tasks.json -- triggers automatically when opening the repo in VS Code
package.json -- hijacks the npm test script
If you have cloned or pulled this repository recently, please do NOT open it in VS Code, Cursor, or any AI coding assistant, and do NOT run npm test until Ionut regains access and reverts the malicious commits.
The good news: the published npm packages are completely safe. No malicious versions were published. This risk only affects people working directly with the source repository.
We have checked our own environments thoroughly and found no traces of compromise. We suspect this may be part of the broader GitHub infrastructure breach carried out by the TeamPCP hacking group in May 2026: https://techcrunch.com/2026/05/20/github-says-hackers-stole-data-from-thousands-of-internal-repositories/
Ionut has filed the #4448974 support ticket with GitHub and is waiting for a response. I wish I could say more than that, but GitHub's support process during a security incident is, frankly, slow and dehumanising. He is a legitimate open-source maintainer, a victim of an attack that may have originated from GitHub's own infrastructure breach, locked out of an account he has been building for years -- and he is sitting here waiting, with no timeline, no direct contact, no way to protect his users himself.
Nearly 20 hours after the incident, the malicious commits are still present in the repositories -- because he cannot revert them without access, and GitHub has yet to act on them directly or come up with a proper reply to the support ticket.
It's deeply frustrating, and if you've followed Mitchell Hashimoto's recent writing about leaving GitHub, you'll understand the feeling.
Regardless, regaining access and reverting the malicious commits will be his absolute first priority the moment GitHub lets him back in.
Thank you for your patience.
This community has always meant a lot to him, and we're truly sorry you're caught in the middle of this.
-- Irinel-Ramona, on behalf of @icflorescu, creator and maintainer of Mantine DataTable
Beta<br>Was this translation helpful?<br>Give feedback.
You must be logged in to vote
All reactions
Replies:
0 comments
-->
Sign up for free<br>to join this conversation on GitHub .<br>Already have an account?<br>Sign in to comment
Category
💬
General
Labels
None yet
1 participant
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
Heading
Bold
Italic
Quote
Code
Link
Numbered...