Incident recap

If you played People Playground between September 21-24, please take these steps now:

• Change your Steam password

• Enable Steam Guard two-factor authentication

• Review your account activity for unauthorised purchases or trades

• Check your email for a message from Steam

• Scan your PC with updated antivirus software

If you were affected, you have received an email from Steam explaining the situation and what to do. If you didn't receive an email, you were most likely not affected.

The game is currently safe to play.

In summary, a few users were infected with a piece of malware that was specifically designed for this game. The malware spread quickly by uploading itself to the Workshop, and inserting itself into existing popular mods. Players who launched the game and were subscribed to these mods would find their mods auto-updating. Once compiled, the malware would delete various personal files, vandalise their Steam account, and upload sensitive information to the Workshop, alongside itself. This information could have been used to log into the player's Steam account.

For some technical background, mods are C# source code that the game compiles on launch. This inherently means that by using mods, you allow potentially unsafe code to run on your computer. Because true C# sandboxing inside Unity is technically impossible without native isolation, the game relied on internal checks to detect suspicious mods. This system has failed.

Active measures

Valve has deleted all items containing C# code, all items that contained sensitive data, and everything uploaded or updated since September 21.

Due to the inherent safety issues with C# mods and auto-updating nature of the Steam Workshop, I can't let this system continue to exist in its current form. Allowing arbitrary code execution at this scale proved to be an unsustainable security risk. C# mods have been deleted and will no longer be officially supported or hosted on the Steam Workshop. Contraptions are unaffected by these changes, but some of them might still have been deleted by Valve.

The Workshop is likely to return. I don't know exactly when or in what state.

Future of the game

I know many people purchased this game understanding that it had mod support, so leaving the game without it is not an option.

I intend to replace the modding system with a dedicated, far safer scripting alternative that is not based on C#. I hope to design this system in collaboration with experienced modders to ensure it provides the required capabilities. Technical details will be shared as development progresses.

Due to the inherent and unavoidable safety issues regarding untrusted code, modding remains a risk for the user. However, this scripting layer will be properly isolated, making it far less likely to cause harm.

That's it

That's all I have to share for now. For what it's worth, I apologise. I know that won't bring back the Workshop and won't undo the damage that's been done. All I can do now is return the game to a state that is worth its price.

A more detailed breakdown and explanation is available here.

---

I've been asked some questions and I'll answer the most frequently asked ones here:

** What languages do you have in mind for the new modding system? **

Lua is by far the best candidate, but JavaScript is also an option.

** Will the existing mods be gone? **

Yes. They have been removed from the Workshop and the game will no longer load them natively.

** Can I still load C# mods somehow? **

*The new modding system will very likely be extendable, running a Lua layer by default. The Workshop will exclusively be for Lua mods and contraptions. The community would then be able to implement their own loaders / languages if they want to, but none of these would be officially supported or allowed on the Workshop.

In short, no, not natively and not officially.*

Is the game safe to open?

Yes, the latest build is safe to run, and has no risk of infection at all. This build of the game is incapable of running any mods.