ECLIPSE FOUNDATION REVOKES LEAKED OPEN VSX TOKENS FOLLOWING WIZ DISCOVERY

Summary from the TLDR InfoSec newsletter

The Eclipse Foundation revoked a small number of leaked Open VSX tokens after Wiz discovered some Visual Studio Code extensions exposing access tokens in public repositories. The investigation showed that the leaks were due to developer mistakes, not a compromise. Eclipse has introduced new token formats, tightened security, improved revocation procedures, and is scanning for malicious patterns.