Malicious code in npp-ml (PyPI)

The npp-ml package on PyPI impersonates a legitimate Notepad++ distribution but actually delivers ADExplorer, an Active Directory analysis tool. This behavior classifies the package as malicious, likely aiming to deceive users into installing unintended software. The campaign associated with this package is labeled '2026-10-npp-ml' and is categorized under malicious intent, including impersonation. The affected versions explicitly identified are 0.1.7, 0.1.8, and 0.1.9. There is no information about active exploitation or available patches.

Users installing the npp-ml package expecting Notepad++ will instead receive ADExplorer, which may lead to unauthorized Active Directory analysis or other unintended actions. This deception can result in trust erosion, potential exposure of sensitive directory information, or misuse of the delivered tool. No direct exploit or vulnerability details are provided, but the malicious nature implies risk to users relying on the package's authenticity.

Users should avoid installing the npp-ml package from PyPI. If already installed, remove the package immediately. Verify the authenticity of packages before installation by checking official sources and package metadata. Since no patch or remediation is provided, the best mitigation is to avoid the malicious package and report it to PyPI maintainers for removal.