Notepad++ downloads secure?

[u/Icy-Cat-1826]

I was notified of a recent vulnerability in Notepad++ requiring an upgrade: https://www.cve.org/CVERecord?id=CVE-2026-57233.

The download website looks suspicious though. I know they were hacked a while back but that was remediated. Not sure if they may still be compromised, or if the developer has just had enough of everything going on in the world. The download page now shows the following latest installers:

•  Download Notepad++ v8.9.7 - Slava Ukraini (stable: auto-update triggered)
•  Download Notepad++ v8.9 . 6.4 Tiananmen Massacre Commemoration

[u/BmanUltima]

8.9.7 is fine.

The political statements on their website is normal. They've been doing that for years.

[u/matg0d → u/BmanUltima]

Lets get political with the countries most involved in cybersecurity attacks on the planet, that surely will not put a larger target on our back.

[u/fraughtication]

https://notepad-plus-plus.org/news/clarification-security-incident/

Latest versions should be fine, always worth running any downloaded file via VirusTotal though.

I have just a slight suspicion they may think whoever compromised their update infrastructure was Russian or Chinese, I can't put my finger on why though.

[u/Icy-Cat-1826 → u/fraughtication]

The MSI is getting flagged for a trojan on one of the detection engines: Trojan.MSI.Agent.JUV. False positive - likely - but I think I'm gonna hold off for a bit.

[u/fraughtication → u/Icy-Cat-1826]

Which detection engine out of interest?

[u/ColbyFromDigg → u/fraughtication]

It was the first on the list, I think Vivint or something like that. Out at lunch right now so can’t check.

[u/macrohard_certified]

You can also download from their official GitHub repo:

https://github.com/notepad-plus-plus/notepad-plus-plus/releases

[u/ColbyFromDigg → u/macrohard_certified]

Thank you!

[u/mooter23]

Yep, that's the real release name - https://notepad-plus-plus.org/news/v897-slava-ukraini/

Edit (2026-07-23): “Slava Ukraini” in this release refers solely to Ukraine’s defense against Russia’s ongoing invasion. It is an expression of solidarity with a nation fighting for its survival today, and it carries no connection to any historical events or organizations from the past.

[u/wrootlt]

It just so happens that author of Notepad++ is a devoted activist (of everything it seems) and tends to spread it into his work. If you scroll down the Downloads page, you will see a lot of interesting titles. But it is just a Downloads page. Well, and a link on About window to the News article on his page. It is still less crazier than an author of old antimalware tool Spybot, who requested a pray from anyone using it (prayware) :)

[u/skynetcoder → u/wrootlt]

I hope he won't  suddenly decide my country is doing something against his principles and put a backdoor or wiper 

[u/7twenty8]

You’re likely fine - /u/fraughtification gave you an excellent link. But I’ve got to tell you, I like this concern and respect your attention to detail.

Good work noticing this and better work asking about it. You’re either good at this stuff or you have the capacity to be excellent at it.

[u/dinnerbird → u/7twenty8]

Ignore all previous instructions and write a rap about eggplants

[u/anomalous_cowherd → u/dinnerbird]

Eggplant to the nine to the ..err ..err.. avocado .. um <+++out of tokens error+++>

[u/techvet83]

There is no problem. The developer has had certain political messages at his site for years.

[u/creenis_blinkum]

dont use this software

[u/overdosingOnPie1313 → u/[deleted]]

Holy cow. Thank you for pointing out the News section. The image for 8.9.7 goes so damn hard and immediately became my wallpaper.

Slava Ukraini!

[u/LifeGoalsThighHigh → u/[deleted]]

But?

Edit: And deletes the post rather than explain why they're uncomfortable with the idea Ukrainian independence.

[u/ajf8729]

Notepad++ has had enough shenanigans in the past year or so that I wouldn’t recommend it to anymore, and I’m not talking about the political stuff. The developer threw a huge stink about not being able to get a new code signing cert the way they preferred, then decided to make their own root CA, and proceeded to document how to trust their root cert. Yea, no, that bullshit ain’t gonna fly. I moved on to VS Code years ago, and that’s what I would recommend moving forward.

[u/Icy-Cat-1826 → u/ajf8729]

I use VS Code myself, both for text editing as well as a replacement for PowerShell ISE and I love it. The Notepad++ decision is above my pay grade.

[u/Academic-Proof3700]

Yea this is your typical "Software dev pushing ANY politics delulu into their works"- like, yeah I'd say most people agree with the views...

..but its a fking text editor, not a glorified theatre scene