“The exact technical mechanism remains under investigation, though the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.”

Fuckall they could really have done about it other than changing host providers, which they mentioned they already have as a result.

main() {
    if (update_available()) {
        exe_path = download_update()
        if (signature(exe_path) == SIGNATURE) {
            install_update(exe_path)
            restart()
        } else {
            put_up_a_warning_or_something()
            delete(exe_path)
        }
    }
# Rest of the application
# ...
}

Note on timelines: The security exper’s analysis indicates the attack ceased on November 10, 2025, while the hosting provider’s statement shows potential attacker access until December 2, 2025. Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated.

I’m only aware of the one (somewhat extended) time described in the article. The dev(s?) has been upfront about what happened and provided updates as they learned more information, hence multiple headlines on the subject.

With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed.

Once

Well now I’m nervous! My first instinct though is that the vast majority of Emacs packages are plain elisp, and Emacs users have a habit of cracking open and tinkering with their packages, so any malicious code ought to be spotted quickly.

With the native compiled modules however, it could be another story…

Text editors with plugin support as potential vectors of malware is a pretty well known problem. It’s why at the very least organisations should be auditing the plugins used and actively monitoring them.

Someone almost managed to inject a vulnerability into the source code for sshd. They planned it for years, and it was only caught because someone noticed unusually high network traffic. Any vulnerability into a core package like that could be massive. Notepad++ is a little smaller, but this is still one of the bigger hacks of the decade.

I think their support of charlie hebdo was different from them getting attacked for it. it’s hard to tell if you’re blaming them for naming a version in solidarity or getting hacked afterwards.

It used to be that being a ML (Malicious Linguist) in someones garage was the rage, now we got “Hackers with Chinese characteristics” smh

Maybe that was in an update.

It does have ninjas though.

Yes, that’s what it means.

And apparently, it happened selectively, not generally, but for specific people/request sources.

It would only be if you use the Notepad++'s own update mechanism. If you used other package managers or went and downloaded the installer to update you’d be fine.

First thing I do every time I (manually) update notepad++ is turn off automatic updates. Automatic updates are the root of all evil