People Playground Lost Its Steam Workshop to Malware. Copy the Apology

On September 21 a malicious mod spread through the Steam Workshop for People Playground, the ragdoll physics sandbox with more than 178,000 Steam reviews. Developer mestiez switched the Workshop off and posted an announcement titled Bad event. Two days later a second post, Incident Recap, said Valve had deleted every Workshop item containing C# code. It was the game's second Workshop malware outbreak of 2026, after one in February.

My take: the security model failed and the developer says so. The communication did not fail. If you run a community around anything players can upload, the two posts on the game's Steam news page are the best free incident template you will get this year.

What the mod did, in the developer's words

The Bad event post opens with "This one is especially bad." It says the mod wiped a considerable amount of personal data, vandalised Steam config and Steam Cloud data, read and published Discord usernames, and published itself to the Workshop in order to spread. That first post said the mod did not steal passwords or tokens. It still told players to change their Discord password. The Incident Recap went further and asked anyone who played between September 21 and 24 to change their Steam password, turn on Steam Guard and review their account.

The recap also explains why this keeps happening. People Playground mods are C# code that the game compiles at launch. The developer wrote that "true C# sandboxing inside Unity is technically impossible without native isolation", so the game leaned on internal checks to spot suspicious mods. Then four words most studios would have cut in legal review: "This system has failed."

The fix is blunt. The recap states: "C# mods have been deleted and will no longer be officially supported or hosted on the Steam Workshop." Contraptions, the saved builds players share, are described as unaffected, though some were deleted in the cleanup. The plan is a replacement scripting system that is not based on C#, with Lua named as the leading candidate. There is no return date. The developer wrote that the Workshop is likely to return and that they do not know when or in what state.

Why the posts are worth copying

Kotaku counted more than 1,000 comments under the announcement, with some players saying they were done with the game. That is what a second outbreak costs. The posts still did several things right, and none of them needed a security team.

• They gave a time window. Players who opened the game with mods between 6 and 8 PM CEST on September 21 knew they were in the first group at risk. Everyone else could calm down a little.
• They listed steps in order. Delete the mods folder, unsubscribe from recently updated mods, check your own uploads for changes you did not make, run a scan.
• They took the blame. The post reads: "This is entirely my responsibility, and we gain nothing from throwing around rumours or speculations."
• They protected the modders. The post says nobody knows who made the mod and asks players not to harass anyone. In a panic, the first target is usually whichever mod author updated last.
• They updated the advice in public. The first post asked for a Discord password change. The recap added the Steam password and Steam Guard, at the top, where nobody could miss it.

What to do if your community shares mods

This is not a one game problem. In April, The Indie Stone removed 14 Project Zomboid Workshop mods from a single uploader after finding what it called heavily obfuscated code that created files outside the game's folder, as PCGamesN reported. And People Playground's own February outbreak ended with a promise of manual approval for changed mods. Seven months later the game was back in the same place, as Gamereactor noted in its report on the second shutdown.

• Write the incident post before you need it. A blank template with four headings: what happened, who is affected, what to do now, what we do not know yet.
• Decide who can pull the plug. One named person with the rights to disable uploads, and one backup in a different time zone.
• Pin the steps everywhere at once. Steam announcement, Discord announcement channel, subreddit sticky. Same wording in all three so screenshots agree with each other.
• Tell your mods team what to say about blame. Accusations against named modders get removed until there is evidence. Put that in the moderator notes today.
• Treat Discord as part of the blast radius. This mod published Discord usernames. Warn members to expect odd DMs and remind them staff will never ask for a login.
• Ask your developers one question. Do our mods run code, or only data? If it is code, ask what stops a popular mod from changing overnight.

The modders who lost years of work here did nothing wrong, and the recap says the developer hopes to design the new system with experienced modders. That is the right instinct. Whether the community is still around when it ships depends on how the next few months of updates are handled.

We run game communities and build the tools behind them, which includes having the bad day post drafted before the bad day.