Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

Notepad++ maintainers reported that nation-state attackers compromised a hosting provider’s infrastructure to selectively intercept and redirect software update traffic to malicious servers, enabling distribution of malicious update manifests; the incident is attributed to a likely Chinese state-sponsored group and spanned roughly June through December 2, 2025. The provider moved affected customers, rotated credentials, and the Notepad++ team hardened the updater to enforce certificate and signature checks for future releases.