Topic starter
20/08/2026 5:26 pm
TL;DR: Notepad++ disclosed that attackers tampered with automatic update delivery through its hosting provider, causing some users to receive malicious payloads and, in reported cases, targeted delivery to a small number of organizations, according to Expel. The incident shows how software distribution trust can be abused even when the overall blast radius is limited, and why update integrity, provenance, and host-level controls matter.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Notepad++ supply chain incident”.
Key questions
Q: What breaks when software update delivery is tampered with?
A: The trust model breaks first.
Q: Why do hosted release channels increase software supply chain risk?
A: Hosted release channels concentrate trust in infrastructure that may sit outside the core development environment.
Q: What are the signs that update integrity controls are failing?
A: Warning signs include download destinations that do not match the expected release path, unexpected changes in hosting or mirror records, and endpoints that show remote access or secondary payload activity immediately after a legitimate update.
Practitioner guidance
- Harden software delivery infrastructure Review who can modify hosting, redirect downloads, or alter update artefacts.
- Validate provenance at the endpoint Require code signing, hash verification, or equivalent trust checks before allowing update execution, and alert when a software package arrives through an unexpected delivery path.
- Log and monitor update path changes Track changes to CDN, web hosting, release mirrors, and update endpoints so selective tampering can be correlated with a specific infrastructure event rather than treated as generic malware.
Bottom line: The incident shows how software supply chains can be abused through delivery infrastructure even when source code remains unchanged.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:15 pm
Software delivery integrity has become a governance control, not just an engineering detail. When update infrastructure can be altered, the trust model that users rely on no longer holds. The practical issue is not only whether a package is signed, but whether the entire distribution path is controlled, observed, and revocable. Practitioners should treat release infrastructure as part of security governance, not just build operations.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat software distribution as part of identity governance?
A: Yes. Whoever can alter a release path effectively acts with the publisher’s delegated authority over downstream users. That makes software distribution a governance issue, because access to hosting, release mirrors, and update mechanisms must be inventoried, limited, monitored, and revoked like any other privileged path.
👉 Read our full editorial: Notepad++ update tampering shows how software delivery can be abused