Is there a real need to go at this level? Notepad++ has a 3rd party plugin model which it happily auto-updates all the time. I wonder what would it take for CIA

Is there a real need to go at this level? Notepad++ has a 3rd party plugin model which it happily auto-updates all the time. I wonder what would it take for CIA (or any big pocketed attackers) to "buy" one of those things and push updates with their own stuff. Chrome extensions are even more merky. Many of these 3rd party popular extensions would be happy to sell their business for couple of millions dollars and let buyer push whatever they wanted.