Notice on Steam Workshop MOD Safety, Anti-Fraud, and Submission Rule Changes.

1. Involved MODs and Handling

The dev team immediately launched an investigation after discovering the issue; some items went from being published to being verified and banned in less than a day. We will continue to monitor related reports, verify newly discovered suspicious items one by one, and take necessary actions based on the results.

Banning the involved MODs can prevent more players from subscribing to and using them, but it cannot automatically restore devices that have run these MODs to a safe state. If you have used suspicious items, or notice abnormal Steam logins, trades, or inventory items, please follow the recommendations in Part 2 below promptly. All MODs were banned before 23:00 on September 19

Banned MOD information is as follows

Scratch Card v1.0.4 published on September 18 at 4:18 AM id=3803401951 Author 步眠 (76561198452222178)

VPet Rhythm Mode | QQ Music / NetEase Cloud Music adapted published on September 18 at 5:11 AM id=3803426816 Author 全体dps停手 (76561198263364253)

SmartPet — AI Smart VPet Hosting Plugin published on September 16 at 12:12 AM id=3802193404 Author 辣鸡DT (76561198379881878)

Note: These MODs are all stolen popular MODs from the Workshop, injected with viruses and re-uploaded to the Workshop. Please do not mistakenly target the original MOD authors. If you have not subscribed to any MOD between September 16 and September 20, 2026, then you do not need to worry about being infected.

We have reported the relevant content to Steam Support and handed the virus samples to professionals for analysis. To strengthen future community management, newly published or updated items must comply with the Workshop terms listed in Part 4 below; previously published items are expected to receive a rectification period of about one month.

Preliminary check of all remaining code plugin MODs

Downloaded all code plugin MODs from the Workshop in one go. Kaspersky and the Red Letter dedicated removal tool both detected nothing.

2. Anti-fraud and Security Reminders

Please be cautious when subscribing to and running MODs from unknown sources. Do not download additional programs as required by MOD pages, private messages, or pop-ups, and do not visit unfamiliar websites to log into Steam. Be especially wary of "Red Letter" or customer service messages impersonating Steam officials: if the other party asks for payment, recharge, transfer of inventory items, or claims that you must complete "verification" before lifting a ban, stop immediately.

If you need to verify your account status, please manually visit the official Steam Support website ( https://help.steampowered.com/ ). Do not click on customer service links provided in suspicious notifications, private messages, or from strangers. It is recommended to use the mobile version of Steam; currently the virus cannot threaten mobile Steam.

If you have already run a suspicious MOD, stop using it immediately and check your device with trusted security software. At the same time, check authorized devices and transaction records on Steam from a trusted device; if necessary, change the passwords of Steam and associated email, and confirm that Steam Guard (Steam Mobile authenticator) is enabled. If you find abnormal logins or transactions, contact Steam Support.

If you find a MOD in the Workshop that may pose a security risk, please send the item link, discovered anomalies, and verifiable evidence to service@exlb.net

3. Protection Measures

To reduce similar risks, the dev team worked overnight to update the high-risk MOD loading interception feature, which intercepts MODs confirmed to have security risks before loading and prompts the reason. Please update VPet Simulator normally through Steam to enable the relevant protection.

Currently, the unified hash signature feature is now available. When authors upload or update MODs, they need to use the built-in Workshop upload tool in VPet Simulator. This feature will provide the following protections:

• Perform integrity verification on MODs to confirm that the current file is consistent with the version signed and uploaded by the original author, reducing the risk of file replacement or tampering.

• Ensure that item names and MOD names are unique. After binding, other uploaders cannot reuse them, thereby reducing the risk of impersonating authors or committing fraud through items with the same name.

Uploading MODs with the same name is prohibited

MODs with tampered DLLs will also be identified

MODs that fail inspection are prohibited from loading and enabling

In addition to in-game protection, we have also written a daily inspection and security feedback process based on the BetterBuy redemption store's Workshop, targeting abnormal changes in subscription/like data for further review by the dev team.

4. Workshop Terms

• It is prohibited to embed malicious code in MODs, steal account information, or use item pages, pop-ups, etc. to induce players to download additional programs, make payments, or transfer items.

• Any plugin that runs code on players' devices must provide a complete source code link corresponding to the released version in the item description; when the code of the released version is updated, the public source code must also be updated synchronously.

• Code plugin MODs must keep the comment section open to facilitate player feedback on usage issues and security concerns.

• Uploading or updating code plugin MODs must use the built-in Workshop upload tool in VPet Simulator.

• Uploading code plugin MODs is prohibited for accounts with less than 10 hours of game time. This has been implemented in the unified hash signature.

5. Notes on Unified Hash Signatures

How to Use the Built-in Upload Feature? Place the completed mod folder in the "mod" folder within the game's root directory. Then, click "Upload MOD" in the VPet settings. It's incredibly convenient.

My MOD is prompted that the author's uploaded version is inconsistent Currently, the method to detect consistency is to check all DLL files in the MOD directory. If your MOD has built-in interfaces or requires additional code to be downloaded, please use the Steam Workshop features to implement them. MOD dependencies and sorting are already in the update plan. Currently, all code plugins are hashes I calculated after downloading from the Steam Workshop. However, for some MODs, I may have used them for a while, resulting in different content. This prompt may still appear; the author can simply update the MOD in MOD management.

My MOD has other prompts that I can't resolve Feel free to email me at service@exlb.net. It could also be a weird bug I wrote.

I don't want to use the unified hash signature feature The MOD folder in the game's root directory will not be checked. If you are not logged into the game via Steam, it will not be checked either.

Special thanks to ChuYiyun & ycxom for monitoring and feedback. And the virus model analysis of lightdustqwq ZhouTienan.