Notepad++ supply chain attack breakdown

>>natebc+(OP)
I'm out of the loop: How did they bypass Notepad++'s digital signatures? I just downloaded it to double-check, and the installer is signed with a valid code-signing certificate.

zlacker