The leak has now been fixed. According to the Open VSX team, the incident has been fully contained and closed since October ...