Studio Minus, the developer of the ragdoll sandbox game People Playground, has disabled Steam Workshop support for the title for the second time this year following a new malware outbreak. The developer announced the decision on September 22, citing "yet another malicious mod" that was "especially bad."
In response to the incident, Studio Minus has released a new build of People Playground that prevents mods from running. The studio stated on Discord that Workshop and mod support will only be reinstated if mods can be proven "fundamentally safe to run," a condition that "might never happen."
A user who inspected the malicious Workshop mod reported that it hijacks the user's Steam account to republish itself on the Workshop, along with the user's personal information. The mod also reportedly destroys files for People Playground and other installed Steam games, and sends offensive messages to the user's Steam friends. While Studio Minus initially claimed the mod did not steal passwords or credentials, the developer is now urging players to change their Discord passwords immediately, as well as the passwords for all other important accounts.
This is not the first time People Playground has faced a malware issue stemming from its Steam Workshop. The game's Workshop was previously disabled in February after a similar outbreak of self-replicating malware. The developer has previously acknowledged the challenges in securing mods, with the primary developer, zooi, describing the game as a "technical hellscape" that makes it "technically impossible to properly sandbox mods in their current state." Zooi characterized the effort to secure mods as a "hopeless arms race."
The ongoing issues with People Playground highlight broader concerns about the security of Steam's Workshop platform. This year has seen several other malware incidents linked to Steam Workshop content, including malicious Project Zomboid mods in April, virus-laden Wallpaper Engine content in June, and malware that led to the hacking of Meccha Chameleon's Discord server in July.