The owner account behind mantine-datatable was suspended after the npm package - and others under the same account - were flagged as compromised.
A disclosure posted on the project's GitHub discussions on June 5 named mantine-datatable alongside an unspecified number of other packages. The scope suggests the compromise extended to everything published under that account, not a single targeted library. The account was subsequently suspended - the standard quarantine when a publisher's credentials are believed to be in hostile hands. Details on the attack vector, the payload, or how many packages were affected were not included in the initial announcement.
For developers with mantine-datatable in their dependency tree, the incident is a prompt to audit which version they pulled and when. Supply chain attacks through hijacked npm accounts work because package managers extend trust to the publisher; once an attacker controls the account, any version they push arrives signed and legitimate-looking. A widely-used UI component library makes a high-value target precisely because it sits close to production code across many projects at once.
Npm account hijacks have become a recurring entry in the supply chain threat catalog. The pattern is consistent: credentials fall, malicious versions ship, the community scrambles. What distinguishes this case is the apparent breadth - multiple packages under one account - which raises the question of how long the attacker held access before anyone noticed.