Notepad++ Supply Chain Attack - Suspicious GUP Network Connection

Tim Peck@timpeck

•updated Feb 2, 2026•8•0•141

Detects WinGUp (gup.exe) making network connections to domains other than the legitimate Notepad++ update infrastructure. Per Kevin Beaumont, gup.exe should only connect to notepad-plus-plus.org, github.com, and release-assets.githubusercontent.com.