The software itself, and the devs, have little to nothing to do with this besides detecting the issue. Which was not obvious, since (it seems) the attack was targeted at specific IPs/hosts/places. It likely worked transparently without alteration for most users, probably including the devs themselves.

It also would only affects updates through the built-in updater; if you disabled that, and/or installed through some package managers, you would not have been affected.

A disturbing situation indeed. I assume some update regarding having adequately digitally signed updates were done (at least, I hope… I don't really use N++ anymore). But the reality is, some central infrastructure are vulnerable to people with a lot of resources, and actually plugging those holes requires a bit of involvement from the users, depending how far one would go. Even if everything's signed, you have to either know the signatory's public key beforehand or get a certificate that you trust. And that trust is derived from an authority you trust (either automatically through common CA lists, or because you manually added it to your system). And these authorities themselves can become a weak point when a state actor butts in, meaning the only good solution is double checking those certificates with the actual source, and actually blocking everything when they change, which is somewhat tedious… and so on and so on.

Of course, some people do that; when security matters a LOT. But for most people, basic measures should be enough… usually.

In the old post from when the update was released a Heise article is linked, that contains indicators of compromise, and in turn links to Kevin Beaumont for the details of his analysis:

https://lemmy.zip/post/54712916
https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

I would just follow their advice, download the newest version from their site directly and use the new versions installer to update manually. I would probably do the same thing when the newest version with certificate and signature verification releases, after that I would assume you should be good to go. However its probably also worth scanning your system for malware just incase you updated during the time frame the attack was live.

I don't think you'll need to uninstall. If I'm reading the article correctly, it looks like they plugged the hole in their update process by switching hosting providers to one that's even more hardened and secure. So requests from the updater should go to the correct place now and not the state-sponsored hacker.

Then in about a month, the next version of notepad++ that is released will also properly validate/verify any downloaded update files from the server.

You could also just disable the checks for updates from within the application too. Or better yet, use something like winget to handle the updates instead of the built-in updater.

Kate

Rename the shortcut to notepad++2?

VSCodium.

Emacs

Notepad++ installed from any package manager was perfectly fine and safe.

Zed! Fastest GUI editor out there other than Sublime Text.

I guess Geany could work?

Sublime 3

Emacs

Ive always had notepad++ crash on large files or xml's with no newlines. I use sublime in those cases :)

That said, as a developer, notepad++ is a very often used tool haha

NotepadQQ 😆

I'm only using Sublime Text and the Notepad that is included with Windows. Not sure exactly what you're looking for.

Three times++, actually. The second attack was documented to have resumed after the third, with different payload URLs.

https://securelist.com/notepad-supply-chain-attack/118708/

I've kind of stopped following things up since I left windows, but maybe you're remembering when this actually happened a while ago? This is just some in-progress post-mortem report.

As someone who switched from npp to Kate in the past year and change, I think npp is way better out of the box. Kate is like a multitool that you need to tweak a lot.

I actually just used it this weekend! On my airgapped Win XP machine. College vibes, very nostalgic.

I know that feeling. You'll never get it back because you grew up.

That feeling you have now is because that era reminds you of simpler times, less worries, less cluttered world. Embrace what you do now, it will be the same feeling in 15 years.

The ability of Kate to pipe selected text through shell commands is very nice. Ctrl+\ or whatever it is.

i knew i recognized the name somewhere earlier today when i learned about it, but i couldn't remember how until i saw this; i was forced to use it because of windows a while back.

i remember liking it too.

still waiting for steel

I don't understand the helix approach.

Let's build a new editor in rust (good), that is in the legacy of vim/nvim[/emacs] (good), that moves to resolve the backwards mechanics of the vim-syntax like meow (good) ... but let's build it all as built in features with no modularity ???

How can you build a new terminal editor like vim/nvim/emacs without realizing that the core strength is that the best features are delivered in plugins. Why would you try to write all of the functionality yourself? Why would you think that a small team can handle all of the work? How can you not realize that external contributors in vim/emacs are the source of the most interesting functionality?

I liked helix, almost as much as emacs w/ meow, but yiu xan't extend it, or write a plugin.

It wasn't specifically notepad++ code, but a custom-written updater. That's why it was connecting to the internet.

I prefer typos to AI slop