News for hackers. Stuff that matters.

A comment on Notepad++ supply chain attack breakdown. Parent comment

Re:Notepad++ supply chain attack breakdown by xvilka on Tuesday February 03, 2026 @10:36PM (#46881154)
There are always Chocolatey and Scoop.
[ Parent | on HN ]
Re:Notepad++ supply chain attack breakdown by chii on Wednesday February 04, 2026 @01:57AM (#46882420)
Why wouldn't those also become a target, if they would grow to be sizable?

And if they have prevention mechanisms, why can't existing supply chains be secured with similar prevention mechanisms, instead of funneling to a single package manager provider?

[ Parent | on HN ]
Re:Notepad++ supply chain attack breakdown by kijin on Wednesday February 04, 2026 @04:18AM (#46883481)
The supply chain for Notepad++ updates was a PHP script on a shared hosting account pointing to the URL of an executable file.

Surely someone with more resources and more sets of eyes could do better than that? AFAIK nobody has compromised Debian's APT repositories and Red Hat's RPM repositories yet.

[ Parent | on HN ]
Re:Notepad++ supply chain attack breakdown by eterm on Wednesday February 04, 2026 @02:35AM (#46882660)
These days there is Winget which I'd rather use than either of those.
[ Parent | on HN ]