Tl;dr: NPP suffered a supply chain attack via their hosting provider. They’ve moved hosts and improved checks performed by the in-app updater. 8.9.1 is the version to be on.