Last week, the team behind Notepad++, the popular free and open-source text editor, published details of a serious supply chain incident that affected the app’s update mechanism between June and December 2025. According to the official advisory, attackers compromised the hosting infrastructure used for delivering updates and were able to intercept and redirect update requests to malicious servers.
What happened
The incident did not involve a flaw in Notepad++’s editor code itself. Instead, the hosting provider used for update distribution was breached, allowing attackers to intercept update traffic destined for notepad-plus-plus.org and selectively redirect certain users to attacker-controlled servers.
Older versions of the Notepad++ updater tool (called WinGUp) lacked strict validation of update authenticity. That gap meant attackers could serve malicious installers in place of legitimate ones if they controlled the network path or the update server responses.
The compromise is now understood to have started in June 2025 and continued until December 2, 2025, when the hosting provider terminated all unauthorised access and fully cleaned up the infrastructure.
How serious it could have been
According to independent security researchers and the Notepad++ developers:
- The attackers were likely state-sponsored, with analysis pointing to sophisticated targeting rather than broad opportunistic infection.
- Some organisations using Notepad++ were reportedly impacted, with the compromised update mechanism leading to malware-like behaviour after installation.
- Rapid7 research has linked related activity to a custom backdoor tool named Chrysalis, deployed by the Chinese APT group Lotus Blossom.
While there are no confirmed widespread public exploits beyond a handful of targeted cases, the targeted nature and long duration of the incident makes this a significant supply chain concern for any environment that relied on automatic updates.
What has changed and what to do now
Notepad++ has taken several steps to secure its update process and protect users:
- The site and update infrastructure have been migrated to a new, more secure hosting provider.
- From version 8.8.9 onwards, the updater verifies installer certificates and signatures, reducing the risk of malicious installs.
- Future releases will enforce mandatory signature verification across all update metadata and binaries.
If you use Notepad++, it’s important to update to the latest version (8.8.9 or newer) as soon as possible and to avoid running older versions with the built-in updater. Users with older releases risk exposure to a similar hijack if an attacker can influence network traffic.
Why this matters
Supply chain attacks like this show that even well-trusted open-source tools can be leveraged by advanced threat actors if the distribution or update infrastructure isn’t hardened. Verifying signatures and securing hosting environments should be baseline practices for any widely used tool.
Over to you 👇
Have you audited your environments for outdated Notepad++ versions yet? Do you think more projects should be forced to adopt signed updates only to avoid similar supply chain issues? Let me know in the comments 💬
References:
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit