In a sobering reminder that even widely trusted open-source projects can become collateral damage in geopolitical cyber conflict, the Notepad++ project has confirmed a prolonged and highly targeted supply-chain attack that compromised its update delivery infrastructure. The incident, which unfolded quietly over several months in 2025, did not stem from flaws in the Notepad++ codebase itself, but from an infrastructure-level breach at its former shared hosting provider.
The disclosure follows the initial security notice published alongside the Notepad++ v8.8.9 release and is the result of an extended investigation conducted jointly by external security experts, the project maintainer, and the hosting provider. The findings paint a picture of a patient, well-resourced adversary exploiting weaknesses beyond the traditional application layer.
Anatomy of the compromise
According to forensic analysis, the attackers gained unauthorized access at the hosting provider level, enabling them to intercept and manipulate network traffic destined for notepad-plus-plus.org. Rather than indiscriminate tampering, the operation was selective: update traffic from specific users was redirected to attacker-controlled infrastructure serving malicious update manifests.
The technical details of the initial intrusion remain under investigation, but investigators have ruled out vulnerabilities in the Notepad++ application itself. Instead, the compromise leveraged weaknesses in the hosting environment, granting adversaries visibility and control over update-related services. This distinction is critical: it underscores how trust relationships in software distribution pipelines can be abused without touching a single line of source code.
The campaign is believed to have begun in June 2025. Multiple independent security researchers, examining the tradecraft and targeting discipline involved, have assessed with high confidence that the threat actor was a Chinese state-sponsored group. The narrow targeting profile and sustained operational security are consistent with espionage-oriented objectives rather than criminal monetization.
Hosting provider findings
As part of the incident response, a dedicated IR plan was established, with direct coordination between the external response team and the hosting provider. The provider’s subsequent investigation yielded several key conclusions.
First, logs indicate that the shared hosting server responsible for handling the Notepad++ update endpoint was compromised until September 2, 2025. On that date, scheduled maintenance included kernel and firmware updates, after which no further evidence of active attacker access to the server itself was observed.
However, the threat did not immediately end there. Despite losing direct server access, the attackers had retained credentials to internal services associated with that environment until December 2, 2025. This residual access may have allowed them to continue redirecting portions of update traffic and returning malicious download URLs during that window.
Notably, the attackers showed no interest in other tenants on the same shared infrastructure. Logs reveal deliberate reconnaissance for the notepad-plus-plus.org domain, suggesting prior knowledge of weaknesses in older update verification mechanisms. Attempts to re-exploit the environment after remediation were detected and blocked, indicating that the attackers actively tested whether their access persisted.
By December 2, 2025, the provider had rotated all potentially exposed credentials, patched the vulnerabilities believed to have enabled the compromise, and verified that no similar indicators of compromise existed across other hosting systems. Clients were proactively migrated to a new server as a precautionary measure early in the investigation.
Timeline reconciliation
There remains a modest discrepancy between assessments. The external security experts concluded that malicious activity ceased around November 10, 2025, while the hosting provider’s internal review identified potential residual access until December 2. Reconciling both views, the most conservative estimate places the full compromise period between June and December 2, 2025, at which point all attacker access was definitively terminated.
From a defensive standpoint, this conservative framing is appropriate. When attribution and dwell time are in question, assuming the longest plausible exposure window is the only responsible course.
Remediation and hardening
The Notepad++ maintainer has issued a direct apology to affected users and moved decisively to address the structural weaknesses exposed by the incident. The project’s website has been migrated to a new hosting provider with substantially stronger security controls, reducing reliance on shared infrastructure.
Equally important are the changes within the application itself. Beginning with v8.8.9, the WinGup updater now verifies both the digital certificate and the cryptographic signature of downloaded installers. The update service’s XML responses are also digitally signed using XMLDSig. Enforcement of certificate and signature verification for update metadata will become mandatory in the upcoming v8.9.2 release, expected within weeks.
These measures materially raise the bar against similar attacks, transforming what was once a soft trust boundary into a verifiable cryptographic chain.
Article source: https://notepad-plus-plus.org/news/hijacked-incident-info-update/
