I'm currently reading We Were Eight Years In Power by Ta-Nahisi Coates. I'm not going to finish it. I've read most of his Atlantic articles and I buy the thesis he's weaving, but I feel like we're past the point where awareness matters (or that I am insufficiently aware). People know the bad they're doing and want it. We're in the activist moment.
I'm next going to start Shift by Hugh Howey because I need some entertainment out of my reading.
tl;dr A network operator can perform a MitM attack on the built-in updater's call-out checking for updates by faking the Notepad++ update website, telling it a new version is available at and then downloading and running the malware
It requires a malicious network operator, or preexisting malware on the host.