From my understanding: Basically the attackers could reply to your version check request (usually done automatically) and tell N++ that there were a new version available. If you then approved the update dialogue, N++ would download and execute the binary from the update link that the server sent you. But this didn't necessarily need to be a real update, it could have been any binary since neither the answer to the update check nor the download link were verified by N++

The previous release already fixed this, or evaded the issue.

The channel was the update mechanism. Upon Notepad++ checking for updates, they were able to inject their own. So if you updated via the apps own update checker they could have misdirected you into installing something else or something modified.

In the old post from when the update was released a Heise article is linked, that contains indicators of compromise, and in turn links to Kevin Beaumont for the details of his analysis:

https://lemmy.zip/post/54712916
https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

I don't think you'll need to uninstall. If I'm reading the article correctly, it looks like they plugged the hole in their update process by switching hosting providers to one that's even more hardened and secure. So requests from the updater should go to the correct place now and not the state-sponsored hacker.

Then in about a month, the next version of notepad++ that is released will also properly validate/verify any downloaded update files from the server.

You could also just disable the checks for updates from within the application too. Or better yet, use something like winget to handle the updates instead of the built-in updater.

Yes, that's the safe way. Uninstall, download current version, install. That's it.

Outside of being compromised already where you would have to notice and fix outside of notepad anyway. But that seems unlikely given the selective attack nature the hoster was able to confirm. If you'd want to cover that you would have to know and do a lot more.

I would just follow their advice, download the newest version from their site directly and use the new versions installer to update manually. I would probably do the same thing when the newest version with certificate and signature verification releases, after that I would assume you should be good to go. However its probably also worth scanning your system for malware just incase you updated during the time frame the attack was live.

Kate

VSCodium.

Emacs

Rename the shortcut to notepad++2?

Three times++, actually. The second attack was documented to have resumed after the third, with different payload URLs.

https://securelist.com/notepad-supply-chain-attack/118708/

I've kind of stopped following things up since I left windows, but maybe you're remembering when this actually happened a while ago? This is just some in-progress post-mortem report.

The timeline says the attack started in June of 2025 and continued through Dec 2, 2025. If you installed, updated, or silently updated during that period you may have been targeted / compromised.

Every version before the previous one.

If you haven't updated you were not vulnerable to the update hijacking.