[Stanley]

Eclipse Foundation Revokes Leaked Open VSX Tokens Following Wiz Discovery

Eclipse Foundation, which maintains the open-source Open VSX project, said it has taken steps to revoke a small number of tokens that were leaked within Visual Studio Code (VS Code) extensions published in the marketplace.
The action comes following a report from cloud security company Wiz earlier this month, which found several extensions from both Microsoft's VS Code Marketplace and Open VSX

https://thehackernews.com/2025/10/eclips...-open.html

[Vectura]

Good move by Eclipse, but it’s wild how often leaked tokens end up inside public repos or extensions. You’d think by now secure publishing pipelines would be standard. At least they caught it early, could’ve been a much bigger mess if those tokens were abused first.