The developers of Notepad++, the open-source code editor for Windows, have released an analysis of an incident that compromised the provider's network infrastructure, resulting in some Notepad++ users downloading tampered executable files via the automatic update delivery system WinGUp.
The attack was carried out through targeted traffic redirection between the user and the update download server. The substitution was made possible due to a vulnerability in the verification and integrity-checking mechanism of the downloaded update. An attacker capable of intercepting transit traffic could substitute the update manifest and initiate a request to download their fake update along with associated integrity-checking metadata.
Further analysis revealed that the attack was executed at the infrastructure level of the hosting provider, allowing the perpetrators to intercept and redirect traffic addressed to the domain notepad-plus-plus.org. The redirection was selectively performed only for certain users, who were provided with a tampered manifest containing update information. The first traces of the attackers' activity date back to June 2025, with the latest on November 10, but the possibility to carry out an attack persisted until December 2.
According to the information provided by the provider, the attack was made possible due to the compromise of the shared hosting server where the notepad-plus-plus.org site was hosted. After the software update on September 2, the loophole was closed, but the attackers had previously obtained credentials to connect to one of the internal services, allowing them to redirect requests to the script "https://notepad-plus-plus.org/getDownloadUrl.php" until December 2. servers. On December 2, the substitution of updates was detected, and the provider blocked access for the attackers. Following the incident, the Notepad++ site was moved to another hosting provider that pays greater attention to security.
In version 8.8.9 of Notepad++, mandatory checks have been added for both digital signatures and certificates for downloaded files to prevent update substitution in Notepad++ and WinGUp. Also, a mechanism to block the application of updates in case of a failed verification has been implemented. The upcoming release 8.9.2, expected within a month, will add a digital signature check for the XML manifest (XMLDSig) returned by the update delivery server.
Source: opennet.ru
