Technology

Three times++, actually. The second attack was documented to have resumed after the third, with different payload URLs.

https://securelist.com/notepad-supply-chain-attack/118708/

I've kind of stopped following things up since I left windows, but maybe you're remembering when this actually happened a while ago? This is just some in-progress post-mortem report.

Notepad++ installed from any package manager was perfectly fine and safe.

I'm only using Sublime Text and the Notepad that is included with Windows. Not sure exactly what you're looking for.

NotepadQQ 😆

Rename the shortcut to notepad++2?

Kate

VSCodium.

Sublime 3

Emacs

I guess Geany could work?

Zed! Fastest GUI editor out there other than Sublime Text.

Ive always had notepad++ crash on large files or xml's with no newlines. I use sublime in those cases :)

That said, as a developer, notepad++ is a very often used tool haha

The software itself, and the devs, have little to nothing to do with this besides detecting the issue. Which was not obvious, since (it seems) the attack was targeted at specific IPs/hosts/places. It likely worked transparently without alteration for most users, probably including the devs themselves.

It also would only affects updates through the built-in updater; if you disabled that, and/or installed through some package managers, you would not have been affected.

A disturbing situation indeed. I assume some update regarding having adequately digitally signed updates were done (at least, I hope… I don't really use N++ anymore). But the reality is, some central infrastructure are vulnerable to people with a lot of resources, and actually plugging those holes requires a bit of involvement from the users, depending how far one would go. Even if everything's signed, you have to either know the signatory's public key beforehand or get a certificate that you trust. And that trust is derived from an authority you trust (either automatically through common CA lists, or because you manually added it to your system). And these authorities themselves can become a weak point when a state actor butts in, meaning the only good solution is double checking those certificates with the actual source, and actually blocking everything when they change, which is somewhat tedious… and so on and so on.

Of course, some people do that; when security matters a LOT. But for most people, basic measures should be enough… usually.

From my understanding: Basically the attackers could reply to your version check request (usually done automatically) and tell N++ that there were a new version available. If you then approved the update dialogue, N++ would download and execute the binary from the update link that the server sent you. But this didn't necessarily need to be a real update, it could have been any binary since neither the answer to the update check nor the download link were verified by N++

The previous release already fixed this, or evaded the issue.

The channel was the update mechanism. Upon Notepad++ checking for updates, they were able to inject their own. So if you updated via the apps own update checker they could have misdirected you into installing something else or something modified.

The timeline says the attack started in June of 2025 and continued through Dec 2, 2025. If you installed, updated, or silently updated during that period you may have been targeted / compromised.