The Notepad++ supply-chain scare is a wake-up call

You probably heard about the Notepad++ supply chain alert. I wrote it up because it's a perfect illustration of where security battles are being fought now — in the build pipeline, not the app.

The ShadowPad angle makes it worse: it's not just malware, it's a deliberate trusted-software compromise. That's the scariest class of attack and it's getting more common.

Worth reviewing how you verify the tools you distribute and the deps you ship. This one is a wake-up call.

I wrote this up in more detail in the full blog post — Critical Alert: Notepad++ Supply Chain Attack & The ShadowPad Malware — with the deeper context, data, and code. Give it a read if you're curious.