The attacks came from a third-party and not from the Notepad++ team.

The program is a free text and code editor that's been downloaded millions of times. The compromise began in June and is likely to have involved a Chinese state-sponsored group.