Dear Eclipse Foundation Committers,
The Eclipse Foundation Security Team has thoroughly scanned all projects for signs of compromise and we have contacted the projects identified as potentially exposed. We are working with them, together with the Release Engineering team, to rotate any potentially compromised secrets and strengthen protections against similar incidents in the future.
As part of this effort, we encourage projects to consider using
Harden-Runner to improve visibility into CI/CD pipelines and make post-incident analysis easier in the event of a broader compromise.
We also recommend pinning GitHub Actions to immutable references rather than floating tags whenever possible. Tools such as
Pinact can help automate this process, while Dependabot can assist in keeping pinned actions up to date.
We also want to acknowledge the work done by the Aqua Security team to address the issue, document it publicly, and notify users.
If your project has used any of the compromised resources, please let us know. We are ready to work with you to assess any potential exposure and determine appropriate next steps.
