If only they told us the IOC so the title can actually be followed up on

It would be nice if there were a test that yhose of us unskilled in pc jargon could run to check all this stuff. A lot of people likely hit by this are familiar with little more than clicking an icon.

Direct link to the indicators of compromise that you can check on

The update system hoster determined the compromise was only used against specific targets, so it's relatively unlikely "normal people" would have been compromised. But if you want to check, you can check on those indicators. These only cover what was discovered on identified compromise, though.

suspected China-state hackers who used their control to deliver backdoored versions of the app to select targets, developers said Monday.

I think its unlikely most people were infected as the article makes it sound like they were focused on targeting specific individuals / organizations.

The protection of dismissing the update dialogue because it appears at start up, which is when I need to get something done. I guess I'll just manually update it from now on.

If you're worried that this may have hit your PC I'd say first of all be aware that this is a state-level backdoor, intended to be persistent and evade detection. You are likely not the target and are very unlikely to find any evidence even if you were targeted, as it is capable of clearing its tracks.

Actions I'd suggest if you're still worried this could have hit your PC:

1. Grab the list of Indicators of compromise from the bottom of this article. Disconnect the PC from the Internet now that you have the list.
2. Search for any instances of these files locally and SHA-256 hash them if found, and match to the hashes on the list. If you find any matches, your system is compromised.
3. Check the DNS cache for any hosts mentioned in the indicators, and if you have network traffic logging you could check there also. Indicators are very likely signs of prior/active attack on your PC.
4. If nothing found, reconnect to the net and continue..
5. uninstall Notepad++, or if you want to keep using it, update Notepad++ via a method other than their internal update method. I suggest powershell using winget as its preinstalled in Win10 & 11.

PS > winget list -q Notepad++
(will show you available updates)
PS > winget upgrade -q Notepad++
(Will install the update if available) 

6. (Optional) disable Notepad++ internal update mechanism, and use winget or another method moving forward. Settings -> Preferences -> MISC: Auto-updater: Disable.

This doesn't seem like this is an attack that should work.

How did this bypass signature verification, sure you can send a malicious update... but unless you have the package maintainer's private keys you can't sign it so it would be thrown out by the package manager?

Stop using Notepad++ This KEEPS happening; we've completely banned the app in our office. The devs keep using outdated and insecure C++. Use a proper, modern editor like micro or zed