The popular text editor Notepad++ has significantly reinforced its auto-update infrastructure by introducing a new “double-lock” update verification mechanism. This architectural change is designed to close the weaknesses that were previously exploited in a sophisticated software supply chain attack targeting Notepad++ users.
How the Notepad++ software supply chain attack was organized
According to a joint technical analysis by Rapid7 and the Notepad++ team, beginning in June 2025 the Chinese threat group Lotus Blossom abused the Notepad++ auto-update channel to distribute malware. Rather than attacking end users directly, the adversaries focused on the project’s update delivery infrastructure.
The key step was the compromise of the hosting provider that supported the Notepad++ update environment. Instead of replacing updates for everyone, the attackers selectively redirected update requests from specific targets to attacker-controlled servers that closely mimicked the legitimate update service.
Rapid7’s investigation revealed that the campaign relied on a custom backdoor dubbed Chrysalis. The malicious distribution is believed to have continued until 2 December 2025, when suspicious activity was detected and the malicious update path was disabled.
Weak point identified: insufficient update authenticity checks
The incident exposed a structural weakness common to many legacy update systems: overreliance on the trustworthiness of the hosting infrastructure. Earlier versions of Notepad++ performed limited, single-layer validation of downloaded updates and associated metadata, assuming that content delivered from the “right” server was inherently trustworthy.
This pattern is typical for software supply chain attacks, where adversaries seek to intercept or impersonate trusted software distribution channels rather than compromise endpoints one by one. Similar tactics were observed in high‑profile incidents such as the SolarWinds Orion compromise and the CCleaner update hijack, where users installed trojanized but apparently legitimate updates.
Evolution of Notepad++ auto-update security controls
Phase one: strengthening WinGUp in Notepad++ 8.8.9
The hardening of the update pipeline began with Notepad++ version 8.8.9. The built‑in updater component WinGUp was upgraded to enforce verification of both the code signing certificate and the cryptographic signature of the downloaded installer. This means that even if an attacker can intercept network traffic, they cannot silently replace the installer with an unsigned or differently signed executable without triggering validation errors.
In parallel, the team started signing the XML response from the update server using XML Digital Signature (XMLDSig). The signed XML includes metadata such as available version, download URLs, and other update parameters. Any modification of these values now breaks the signature and is detected by the client.
Phase two: double-lock update verification in Notepad++ 8.9.2
With Notepad++ version 8.9.2, the project introduced a full double-lock mechanism that combines these two independent controls into a layered defense model. The update process is now protected by two separate verification steps:
1. Installer signature and certificate validation. The client verifies that the update executable is signed by the expected publisher, and that the associated certificate is valid and not revoked. This protects against unauthorized or tampered binaries.
2. Signed XML metadata (XMLDSig). The client validates the integrity and authenticity of the XML metadata describing the update. Any change to the version number, download URL, or other parameters causes signature verification to fail, blocking the update.
The combination of these independent trust anchors substantially raises the bar for attackers. Even if part of the infrastructure is compromised, an adversary must now defeat both verification layers to deliver a malicious update that the client will accept—making exploitation of the update channel significantly more difficult.
Practical implications for users and organizations
The Notepad++ development team strongly recommends that all users upgrade to version 8.9.2 or later and obtain installers only from the official domain notepad-plus-plus.org. This is especially critical in environments where Notepad++ is used for software development, administration, or log analysis, as these systems often have elevated access to sensitive data and infrastructure.
From a broader software supply chain security perspective, organizations can reduce risk by following several key practices:
— Rely exclusively on official distribution channels. Unofficial mirrors, third‑party archives, and unvetted repositories introduce additional attack surface and increase the likelihood of file tampering.
— Systematically verify digital signatures and hashes. In enterprise environments, signature checks and integrity verification of critical software and updates should be automated and integrated into deployment pipelines and endpoint security tooling.
— Apply the principle of least privilege to updaters. Auto-update components should run with minimal necessary rights. Reducing their privileges limits the potential impact if an updater is ever compromised.
The Notepad++ response illustrates that even mature, widely used open‑source projects must continuously reassess their trust model for updates. As software supply chain attacks remain one of the most damaging and hardest‑to‑detect threat vectors, adopting multi‑layer verification, strong cryptographic signing, and independent integrity checks is becoming a baseline requirement. Organizations that treat update channels as critical infrastructure and harden them accordingly will be far better positioned to withstand the next wave of supply chain–focused attacks.
