People Playground is abandoning its existing C# mod system after malware spread through the game’s Steam Workshop. In an official incident recap, developer Studio Minus said the latest build is safe to open because it cannot run mods.
The studio said a few users were infected by malware built specifically for the game. It spread by uploading itself to the Workshop, inserting itself into popular mods and reaching subscribed players through automatic updates. Once the game compiled the infected code, the malware could delete personal files, vandalize a player’s Steam account and upload sensitive information back to the Workshop. Studio Minus said that exposed information could have been used to access a player’s account.
Why the old system failed
People Playground’s mods were written as C# source code that the game compiled at launch. Studio Minus said the game relied on internal checks to catch suspicious behavior because fully isolating C# inside Unity would require native sandboxing. The developer concluded that those checks failed and that letting Workshop items execute arbitrary code at this scale was an unsustainable risk.
Valve has since deleted Workshop items containing C# code or sensitive data, along with everything uploaded or updated since September 21, according to the recap. C# mods will no longer be officially supported or hosted on the Workshop. User-created contraptions are not covered by that ban, although the developer warned that Valve’s cleanup may have removed some of them.
