Poisoned Pipeline / Incidents / AS194

AS194 · 2025-06

Notepad++ update-server hijack (Jun–Dec 2025)

Windows softwareInstaller / update channel

GTIG attributes UNC6688 to a compromise of hosting infrastructure
serving Notepad++ updates from June to December 2025. First-party
incident note from the Notepad++ project. Traditional update-channel
supply chain (same class as CCleaner/ShadowHammer), not a language
registry.

Mapped techniques

• T0209 Compromise package registry or CDN origin
• T0121 Compromised legitimate artifact

supply-chain update origin

Sources

• https://notepad-plus-plus.org/news/hijacked-incident-info-update/
• https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise
• https://securelist.com/notepad-supply-chain-attack/118708/