---
title: "Security Bulletin: Active Supply Chain Compromise of Notepad++ Installer and Update Mechanism"
description: Notepad++ supply chain attack compromises official installers with backdoored code enabling remote execution. Critical severity. Reinstall clean version 8.8.9 or later immediately.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin: Active Supply Chain Compromise of Notepad++ Installer and Update Mechanism](https://www.redlegg.com/blog/security-bulletin-active-supply-chain-compromise-of-notepad-installer-and-update-mechanism)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 2/3/26 9:32 PM

About:

Chinese state-linked threat actors have compromised the installer and update mechanism associated with Notepad++ Project, injecting malicious code into Windows installer binaries distributed via official channels. The implanted backdoor enables arbitrary code execution and establishes outbound communication with attacker-controlled infrastructure, allowing remote command execution and potential full system compromise. This activity has been confirmed as actively exploited in the wild and represents a high-impact supply chain attack affecting developer and user environments.

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

### Active Supply Chain Compromise of Notepad++ Installer and Update Mechanism

 

**Exploit or POC**: This activity was actively exploited in the wild.  
**Update**: 

The Notepad++ project has remediated the issue and released clean, verified installers.

 

**Severity: **Critical

Required upgrade path:

All users should upgrade to Notepad++ version 8.8.9 or later.

 

**Official release site:**

[https://notepad-plus-plus.org/](https://notepad-plus-plus.org/)

**Description**:

Chinese state-linked threat actors compromised the Notepad++ update and installer process, injecting a backdoor into Windows installer binaries distributed via official channels. The malicious code enabled arbitrary code execution and outbound communication to attacker-controlled infrastructure.

 

**Mitigation Recommendation**: 

Immediately uninstall any potentially affected versions of Notepad++ and perform a clean installation of version 8.8.9 or later from the official project site.

 

 

[View full post](https://www.redlegg.com/blog/security-bulletin-active-supply-chain-compromise-of-notepad-installer-and-update-mechanism)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2026-02-03T21:32:03.238Z",
  "datePublished" : "2026-02-03T21:32:03Z",
  "headline" : "Emergency Security Bulletin: Active Supply Chain Compromise of Notepad++ Installer and Update Mechanism",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletin-active-supply-chain-compromise-of-notepad-installer-and-update-mechanism",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```