News for hackers. Stuff that matters.

A comment on Notepad++ supply chain attack breakdown. Parent comment

Re:Notepad++ supply chain attack breakdown by chii on Wednesday February 04, 2026 @01:57AM (#46882420)
Why wouldn't those also become a target, if they would grow to be sizable?

And if they have prevention mechanisms, why can't existing supply chains be secured with similar prevention mechanisms, instead of funneling to a single package manager provider?

[ Parent | on HN ]
Re:Notepad++ supply chain attack breakdown by kijin on Wednesday February 04, 2026 @04:18AM (#46883481)
The supply chain for Notepad++ updates was a PHP script on a shared hosting account pointing to the URL of an executable file.

Surely someone with more resources and more sets of eyes could do better than that? AFAIK nobody has compromised Debian's APT repositories and Red Hat's RPM repositories yet.

[ Parent | on HN ]