Notepad++ hijacked by state-sponsored actors

Re:Notepad++ hijacked by state-sponsored actors by sodality2 on Sunday February 01, 2026 @11:39PM (#46852467)

How do you deal with the opposite, software that you forget to update but contains vulnerabilities discovered/exploited later?

[ Parent | on HN ]

Re:Notepad++ hijacked by state-sponsored actors by Lammy on Sunday February 01, 2026 @11:49PM (#46852524)

I use a package manager that checks the hash of the downloaded installer against what's recorded in the package listing for that version. WinGet has been built in to Windows since one of the 2018-era releases of Windows 10: https://i.ibb.co/VYGXdc56/2026-02-01-20-46-28-Greenshot.png

[ Parent | on HN ]

Re:Notepad++ hijacked by state-sponsored actors by hypeatei on Monday February 02, 2026 @06:55AM (#46854972)

Integrity checks say nothing about the package authenticity, though. State sponsored actors could just... change the hash on the listing in a hypothetical attack.

[ Parent | on HN ]

Re:Notepad++ hijacked by state-sponsored actors by Lammy on Monday February 02, 2026 @03:04PM (#46860658)

“Just” lol

That would be two things that would have to be compromised and redirected simultaneously to malicious versions. Way more likely to be noticed too because one of them would be GitHub, and unless they mirror the entire rest of the package metadata index and keep it up to date for everything else besides their targeted malicious package.

[ Parent | on HN ]