It seems that every piece of software these days has a plugin system to allow you to extend its functionality. This is great for usefulness but can be a nightmare for security.

Notepad++ is the latest victim of plugin abuse, but we've seen this in numerous other platforms as well. Browsers are the biggest problem as they are used by everyone. Software development platforms like Visual Studio Code are also a high value target for attackers. We could even pull in mobile app stores, if we stretched the definition of plugin a bit.

Why are these such fertile ground for attacks? First, they are so ubiquitous in daily life. Every app wants to be extensible so it can meet the needs of its users. Second, these plugin repositories are often an afterthought and not very well policed by the vendor.

In many cases, the process to get a plugin added is based on trust rather than verification. Finally, the trust is there. Users see the browser or app branding in the extension store and mistakenly extend that trust to the extension and its author.

It doesn't take much for an attacker to create a malicious plugin and get it published. Ease of use and accessibility was the way of the Internet long before security was a concern. We still struggle to realize that sometimes.

So what can you do? First, be mindful of the risk when you are browsing the plugin repositories. Try to stick with well-known plugins from well-known vendors. Don't go off installing obscure plugins with 3 ratings from a company in Russia.

Second, curate your plugins just like you should your apps. If you aren't using it, remove it. Keep a "least functionality" mindset - only what you need and no more. Finally, search for news on those plugins and authors before installing them.

Use the wealth of information you have at you fingertips to investigate first. Don't be so trusting.

Reference:
https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/