Notepad++ hack: Supply chain threats evolve

The developers behind Notepad++ acknowledged on Monday that an attack on a shared hosting server in June 2025 led to a damaging compromise of the popular source-code editor’s update process — and the installation on targeted systems of a custom-developed backdoor application dubbed “Chrysalis.” 

Notepad++ said the attack began with a hack of a shared hosting server in June 2025 by malicious actors affiliated with China. The compromise enabled the attackers to intercept and redirect Notepad++ update requests from targeted users and organizations to malicious servers controlled by the attackers, resulting in the download of the Chrysalis malware. 

The attack, which first came to light in December, highlights the growing risks facing software engineering teams as malicious actors look to exploit the diverse and vulnerable infrastructure used to maintain and manage deployed applications. 

Here’s what you need to know about the Notepad++ compromise — and how it marks an evolution of software supply chain attacks.

Download: Software Supply Chain Security Report 2026Join discussion: Report webinar

How the Notepad++ compromise happened

Security researcher Kevin Beaumont said the malicious actors “specifically targeted the Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++,” including the use of a self-signed root certificate to sign updates.

Ars Technica reported that Beaumont first got interested in the Notepad++ application after noticing details in bug fixes for Notepad++ Version 8.8.8 in November. Those included changes to “harden the Notepad++ Updater from being hijacked to deliver something … not Notepad++.”

Specifically, an updater application known as WinGUP, or just GUP, was altered. GUP is used to report the version in use to the notepad-plus-plus(dot)org domain and then retrieve a URL for the Notepad++ update from a file named gup.xml. That file is then downloaded to the %TEMP% directory of the requesting device and executed.