What we know about the Notepad++ supply chain attack

(updated 4-Feb-2026 with information from Hostinger and Validin)