this post was submitted on 03 Feb 2026
22 points (100.0% liked)

Opensource

6897 readers
111 users here now

A community for discussion about open source software! Ask questions, share knowledge, share news, or post interesting stuff related to it!

CreditsIcon base by Lorc under CC BY 3.0 with modifications to add a gradient

⠀

founded 3 years ago
MODERATORS
pylapp@programming.dev
22
Notepad++ hijacked by state-sponsored hackers (notepad-plus-plus.org)
submitted 8 months ago by pylapp@programming.dev to c/opensource@programming.dev
4 comments fedilink hide all child comments
all 5 comments
sorted by: hot top controversial new old
[–] Wurzelfurz@feddit.org 5 points 8 months ago

He added a link to a deep dive for the backdoor used in the attack.

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

[–] artyom@piefed.social 2 points 8 months ago (2 children)

I'm so confused.

  1. It doesn't say anything about "state-sponsored attackers" outside of the headline? What state? Why?
  2. Why is a Notepad app connecting to any servers or have credentials at all?
[–] DemBoSain@midwest.social 1 points 8 months ago (1 children)

It wasn't specifically notepad++ code, but a custom-written updater. That's why it was connecting to the internet.

[–] village604@adultswim.fan 2 points 8 months ago

I mean, it is n++ code because the updater is part of the code base. They just didn't have the connection to the update server hardened.

This was patched in like December, though.