If you played People Playground between September 21-24, please take these steps now:
- Change your Steam password
- Enable Steam Guard two-factor authentication
- Review your account activity for unauthorised purchases or trades
- Check your email for a message from Steam
- Scan your PC with updated antivirus software
If you were affected, you have received an email from Steam explaining the situation and what to do. If you didn't receive an email, you were most likely not affected.
The game is currently safe to play.
In summary, a few users were infected with a piece of malware that was specifically designed for this game. The malware spread quickly by uploading itself to the Workshop, and inserting itself into existing popular mods. Players who launched the game and were subscribed to these mods would find their mods auto-updating. Once compiled, the malware would delete various personal files, vandalise their Steam account, and upload sensitive information to the Workshop, alongside itself. This information could have been used to log into the player's Steam account.
For some technical background, mods are C# source code that the game compiles on launch. This inherently means that by using mods, you allow potentially unsafe code to run on your computer. Because true C# sandboxing inside Unity is technically impossible without native isolation, the game relied on internal checks to detect suspicious mods. This system has failed.
Active measures
Valve has deleted all items containing C# code, all items that contained sensitive data, and everything uploaded or updated since September 21.
Due to the inherent safety issues with C# mods and auto-updating nature of the Steam Workshop, I can't let this system continue to exist in its current form. Allowing arbitrary code execution at this scale proved to be an unsustainable security risk. C# mods have been deleted and will no longer be officially supported or hosted on the Steam Workshop. Contraptions are unaffected by these changes, but some of them might still have been deleted by Valve.
The Workshop is likely to return. I don't know exactly when or in what state.
Future of the game
I know many people purchased this game understanding that it had mod support, so leaving the game without it is not an option.
I intend to replace the modding system with a dedicated, far safer scripting alternative that is not based on C#. I hope to design this system in collaboration with experienced modders to ensure it provides the required capabilities. Technical details will be shared as development progresses.
Due to the inherent and unavoidable safety issues regarding untrusted code, modding remains a risk for the user. However, this scripting layer will be properly isolated, making it far less likely to cause harm.
That's it
That's all I have to share for now. For what it's worth, I apologise. I know that won't bring back the Workshop and won't undo the damage that's been done. All I can do now is return the game to a state that is worth its price.
A more detailed breakdown and explanation is available here.