Thanks Chris.

Definitely not point 1. 

Our guys also suspect that it is the oxwall test server or the store itself? Or even worse - someone leaked it from the inside?

Has this happened to other developers before?

 

Ummm... yes... please see this topic: 

https://developers.oxwall.com/forum/topic/48313

Seems to me a lot of breaches are happening these days.  And everyone seems to be just doing the "no comment" thing, as per usual.

you can find this guy here:

http://www.plati.com/seller/svitlo/96836

looks like he from Ukraine and selling scripts

here more information about him his fully name:

i know only one Alexandr working here but i think he from russia not Ukraine ...hehe

http://domainbigdata.com/mail.ru/email-id/30N6pIJQGO4dUfC9fgjRzQ

He have many domains this guy

try call him...looool....his number is available but i think the number is not correct but who knows :)

i find very much about this guy on internet but many website are in russia language or ukraine language maybe same language i do not know so much about that...anyways he is not anonymous directly...loool

maybe he did feel you plugin was very great and want to sell the script on the website he seling scripts :) I do not know but i feel if you do something illegal then you need to bee sure you are anonymous totally to avoid problems but he feel maybe he very safe in Ukraine or Russia doing things like this that my guess 

try contact him on Skype that are available on internet probably he would not open and chat with you but i would try if i was you...

Thanks for the pointer Marcus