notepad-plus-plus / notepad-plus-plus/nppPluginList

Possible malware in blitzsearch plugin

Open
#881 4 comments 0 reactions 1 assignee View on GitHub

@donho is already working on this.

Since Oct 15, 2025.

Dominant language
Python
Stars
1.7k
Forks
491
Avg merge
2d 4h
Merged PRs (30d)
22

Description

I was downloading some of these and google chrome stopped me from downloading the blitz search one. I decided to turn off windows defender and upload the dll to virustotal and I saw a huge number of detections. Here is the issue I opened on their repo. It's possible someone could have been compromised so I'm not saying that I necessarily think this was intentional. https://github.com/Natestah/BlitsNppPlugin/issues/3

Here is the virustotal report: https://www.virustotal.com/gui/file/3a2f63596116d45352b7dc360441343fbb772e43f3ee554baffd367d6270dc06

I suggest that this plugin be removed from the list or at least labelled as proceed with caution for now until this is addressed. I am aware that false positives are a thing absolutely, but the nature of these detections imply that the dll is crypted and there are 41 of them whereas my comfortable threshold for false positives is usually no more than like 7. Just wanted to put this out there, be safe everybody.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.