Notepad++ update compromise shows supply chain trust is fragile

At a glance

What this is: This is an analysis of how attackers abused Notepad++ update infrastructure to push malicious executables through a trusted updater.

Why it matters: It matters because enterprise IAM and security teams cannot treat software update channels as inherently trustworthy when delivery infrastructure and payload verification are both weak.

Context

Notepad++ update compromise is a supply chain security problem, not a code vulnerability problem. The article shows how attackers can turn a legitimate software update path into a delivery mechanism when hosting infrastructure is compromised and the updater does not verify what it downloads.

For identity and access programmes, the key issue is trust delegation across software delivery. If an updater can execute content from a remote source without strong authenticity checks, the organisation has effectively extended trust to infrastructure it does not control.

Key questions

Q: What breaks when a software updater trusts the download path but not the binary itself?

A: The update process becomes an execution channel for whoever controls the hosting or redirect layer. A user may appear to install a legitimate update, but the updater can still launch attacker-controlled code if it does not verify the payload’s certificate and signature before execution.

Q: Why does compromised update infrastructure create such a large supply chain risk?

A: Because it lets attackers borrow the legitimacy of the publisher’s normal delivery workflow. Instead of defeating endpoint controls directly, they exploit a trusted path to deliver code that users and monitoring tools are less likely to question, especially when the compromise is selective.

Q: How can security teams tell whether an update channel is actually trustworthy?

A: Look for independent payload verification, restricted outbound destinations, and clear provenance checks before execution. If the updater can reach multiple uncontrolled endpoints or run a downloaded binary without cryptographic proof of origin, the channel is not trustworthy enough.

Q: What should teams do when a widely used internal tool is found to have an update compromise?

A: Treat the update mechanism as potentially tainted, not just the application. Investigate affected endpoints, review process execution around the update window, block suspicious updater network paths, and move to a controlled manual or centrally managed distribution method until trust is restored.

Technical breakdown

How compromised hosting turns an updater into a delivery path

WinGUp is the update component used by Notepad++ to fetch an update manifest and then download and execute an installer. In this case, attackers did not need a software flaw in the editor itself. They compromised the hosting environment behind the update flow, then selectively redirected traffic so targeted users received attacker-controlled manifests and binaries. That pattern matters because the updater trusted the retrieval path more than the payload provenance. When the path is compromised, the software update process becomes an execution channel rather than a protection control.

Practical implication: verify update payload authenticity independently of the transport path and hosting layer.

Why missing signature verification creates trust collapse

The decisive weakness was not just infrastructure compromise. Prior to v8.8.9, WinGUp did not enforce certificate and signature verification on downloaded installers, so a malicious binary could be executed after a normal update check. Even with later changes such as certificate signing and GitHub-only downloads, the updater still lacked strong binary authenticity enforcement until verification was added. This is a classic supply chain integrity failure: the system assumed that a legitimate-looking download source was enough to establish trust in the executable itself.

Practical implication: require cryptographic verification of update binaries before execution, not after download.

How selective redirection makes detection harder

The article describes selective targeting, not broad compromise noise. Attackers searched for the Notepad++ domain and redirected only certain users to malicious infrastructure, which meant most update checks still looked normal. That reduces the value of simple allowlisting and makes network telemetry and endpoint process monitoring more important. When the attack is selective, defenders cannot rely on universal breakage or obvious service outages as indicators. The malicious event is hidden inside a legitimate workflow that still succeeds for most users.

Practical implication: monitor updater child processes and outbound destinations rather than assuming a normal update flow is safe.

Threat narrative

Attacker objective: The attackers aimed to deliver malicious executables through a trusted update mechanism so they could achieve selective code execution on targeted systems.

1. Entry occurred through compromise of the shared hosting infrastructure behind notepad-plus-plus.org, giving attackers control over the update delivery path.
2. Credential and access persistence followed when attackers retained internal service credentials after direct server access was disrupted, allowing continued traffic manipulation.
3. Impact came when targeted users downloaded and executed malicious installers through WinGUp, resulting in code execution with user privileges.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• SpotBugs token leak 2025: A SpotBugs maintainer's PAT, stolen via a pull_request_target workflow in 2024, started the reviewdog and tj-actions supply chain attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Update trust is only as strong as binary authenticity verification: This incident shows that a trusted delivery channel does not equal a trusted payload. The updater accepted content from compromised infrastructure because the process did not fully prove what it was about to execute. For practitioners, the lesson is that supply chain trust must be enforced at the executable boundary, not inferred from the source URL.

Selective redirection is the governance blind spot in software delivery: Attackers did not need to break every user or every package. They needed only enough control to steer specific targets into a normal-looking update flow. That means risk decisions based on average patch hygiene miss the real exposure window, especially for tools widely deployed in developer and IT environments.

Supply chain identity now includes the update path, not just the publisher: The relevant trust object is no longer only the software vendor. It is also the hosting layer, the manifest, the download destination, and the verification logic that binds those elements together. Practitioners should treat update infrastructure as part of the identity perimeter for software execution.

Identity blast radius grows when execution follows trust instead of proof: This compromise worked because the updater trusted the path before proving the artifact. That creates a larger blast radius than ordinary phishing or endpoint malware because the attacker borrows legitimate software behaviour to deliver the payload. Security teams should think about update channels as privileged execution routes, not convenience features.

Controlled software distribution needs provenance, verification, and revocation together: The article maps cleanly to OWASP-NHI and supply chain integrity concerns even though no human account was directly targeted. The practical conclusion is that software delivery governance must be able to revoke trust in a path, not just patch a binary after the fact.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Trusted delivery is not trusted execution: The important governance shift is to separate where software comes from from what is allowed to run. Update channels need provenance controls, destination controls, and execution controls working together, otherwise a compromise of the distribution layer becomes an execution event.

Identity blast radius is expanding into software supply chain governance: Software delivery paths now behave like privileged identity paths because they can authorize code onto endpoints. That makes update infrastructure part of the identity perimeter, not just a build-and-release concern.

92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs. The same exposure logic applies to software update infrastructure: if the trust boundary is porous, the execution boundary is too.

For practitioners

• Enforce binary verification before execution Require update mechanisms to validate certificate and signature integrity on the downloaded installer before any execution step. If the updater cannot prove payload authenticity end to end, block automatic installation and route users to a controlled manual update path.
• Restrict updater network reachability Limit update components such as gup.exe to approved destinations only and alert on any non-standard outbound connection. This reduces the chance that a compromised manifest or redirected download path can reach attacker-controlled infrastructure.
• Audit endpoints exposed during the compromise window Search for systems that ran vulnerable Notepad++ versions during the June through December 2025 window, then inspect process creation, temporary files, and unexpected child processes associated with update activity.
• Move software delivery into controlled package management Where possible, centralise application distribution so update trust is mediated by enterprise controls rather than user-triggered retrieval from external infrastructure. This is especially important for developer tools that run with broad workstation access.
• Monitor for updater abuse patterns Flag update components that spawn unexpected child processes, write unusual temporary executables, or connect to file-sharing and anonymous hosting services during what should be a routine patch workflow.

Key takeaways

• The compromise shows that a legitimate update mechanism can become a code execution path when hosting infrastructure and binary verification both fail.
• Selective redirection made the attack harder to spot because most users still saw a normal update experience.
• Independent verification of update artifacts is the control that limits this kind of supply chain abuse most directly.

Key terms

• Supply Chain Trust: Supply chain trust is the confidence that the people, software, hardware, and services used to build and run a system are authentic, intact, and behaving as expected. In security practice, it depends on verifying provenance, integrity, dependencies, and update paths across suppliers, build systems, and operational handoffs.
• Binary Authenticity Verification: Binary authenticity verification is the process of proving that a downloaded executable is the expected one before it is run. For update systems, this means checking certificates, signatures, and provenance at execution time so a compromised server cannot substitute malicious code.
• Update Channel: An update channel is the path software uses to check for, download, and install new versions. It becomes a security boundary when users trust that path to deliver safe code, which is why it needs the same governance as other privileged execution routes.
• Selective redirection: Selective redirection is an attack pattern where only chosen users or requests are sent to malicious infrastructure while normal service continues for everyone else. It reduces visibility, delays detection, and often signals an espionage-oriented operation rather than broad commodity malware.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.