The update button is part of your attack surface

For about six months in 2025, the servers that delivered Notepad++ updates weren't entirely in the maintainer's hands. The editor's code was fine. The pipe it travelled down wasn't.

That's what makes supply chain attacks so annoying. Nothing you wrote was wrong, nothing you scanned looked odd, and the "new version available" prompt is one you've clicked a hundred times. Notepad++ disclosed the compromise on February 2, 2026, and researchers attributed the activity to a Chinese state-linked group called Lotus Blossom. Around the same time, EmEditor's official download site was compromised to push infostealer malware. Two popular editors, a similar trick.

You can't out-careful this by getting better at spotting phishing. What helps is making your own setup a little less trusting of whatever arrives through the usual channels, and three habits get you most of the way.

First, pin your build steps to a commit instead of a tag. Tags can be moved after the fact. A full commit SHA can't.

yaml

• uses: actions/checkout@v4 # a tag can be re-pointed under you
• uses: actions/checkout@PASTE_COMMIT_SHA # a full commit SHA can't

Second, check installers against a hash you got from somewhere else. If the checksum sits on the same page as the download, a compromised host can swap both.

powershell
Get-FileHash .\installer.exe -Algorithm SHA256
bash
sha256sum installer.deb

Third, let someone else update first. Run dev tooling updates on a throwaway machine, or just wait a few days, so security researchers have time to flag a bad release before it reaches your laptop.

One more, because it's the newest way to get burned: if an AI assistant tells you to pip install or npm install a package you've never heard of, look it up before you run it. Attackers register the names that models tend to invent, which people now call slopsquatting.

We wrote up the wider picture, from Notepad++ to deepfake phishing, on Vaudacia. See Details