I went to download Notepad++ and noticed that the official website looked unusual to me. I then found reports about a previous compromise involving the site or its update process, along with an incident update from the project. There is also a torrent containing an archived copy of the site's public-facing files, but I'm not sure whether downloading it would be safe or useful. Should I install Notepad++ now, and if so, what steps should I take to verify that the installer is genuine?
4 Answers
The reported issue was tied to the automatic updater and was fixed some time ago. If you want to avoid the updater entirely, download a current installer manually and disable automatic updates until you’ve confirmed the release and signature.
The website looks normal from my side, and the recent installer has been used successfully. The safest approach is to download only from the official project site, then verify the installer’s SHA-256 hash and digital or GPG signature against values published through a trusted project channel. Don’t use the magnet link as an installer source; an archive of website files doesn’t prove that an executable is safe.
You can also install it through a package manager such as winget or another managed software repository, but don’t blindly trust any package manager. Check the package ID, publisher, version, hashes, and signature before deploying it broadly.
It’s understandable to move away if the project’s security history makes you uneasy. Notepad++ is useful software, but if you can’t establish a reliable chain of trust for the download, choose an alternative editor that fits your organization’s security requirements.
I’d still test it in a sandbox first if you’re uncomfortable. The project has had enough security-related incidents that independent verification is reasonable.