If I’m reading this correctly, the headline is…very inaccurate.

It looks like a dispute between two developers in Organic Maps, who both started out at Maps.me, specifically over whether their CDN redirector should be public or private.

I had to check…

https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v7.3.3

O_o

Edit:

Yeah, it was real! Back in 2017.

https://notepad-plus-plus.org/news/v733-fix-cia-hacking-npp-issue/

Checking the certificate of DLL makes it harder to hack. Note that once users’ PCs are compromised, the hackers can do anything on the PCs. This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn’t prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.