Mantine-datatable (and others) compromised – owner account suspended

Comments converged on the second scenario. People reading the injected code said it behaved like an infostealer that searched for GitHub secrets and Kubernetes secrets, then exfiltrated them either to a command-and-control server or to new repos created under the victim's own account. Others said this matches a wider wave of GitHub compromises discussed in another recent post, with one person building a cleanup tool calling it a worm and urging immediate token and password rotation for anything used in infected repos. The mood was angrier at GitHub than at the attacker mechanics. The strongest complaint was operational, not philosophical: suspending the maintainer while leaving the malicious package live is the exact opposite of incident response. Several people said this is pushing them toward Forgejo, Codeberg, or self-hosted setups. A few also argued the real attack surface is GitHub Actions and other tooling that automatically executes repository content. The practical lesson was blunt: repository hosting is now part of your production security boundary, and convenience features that run code on trust can turn one stolen account into a broader secret-harvesting event.