People Playground disables mods again after second malware outbreak

People Playground, a Steam sandbox where players interact with physics-based ragdolls, has disabled Steam Workshop support for the second time this year after a malicious mod surfaced on September 21.

Developer Mestiez announced the shutdown on September 22, calling the latest threat "especially bad." Anyone who played with mods between 6 PM and 8 PM CEST on September 21 was urged to run antivirus scans immediately and delete all mods from their mods folder.

According to analysis and the developer's statements, the malware can hijack Steam accounts to republish itself on the Workshop, destroy files for People Playground and other installed Steam games, wipe personal data, vandalize Steam config and cloud data, and publish Discord account information to the Workshop.

Initially, Mestiez stated the malware "does not steal passwords, tokens, cookies, or other credentials." That claim has since been crossed out, and the developer now recommends changing passwords for all important accounts to invalidate any compromised session tokens.

This marks the second Workshop malware incident for People Playground in 2024. In February, a similar self-replicating malware attack prompted the first temporary Workshop shutdown.

In a blog post from last month, primary developer zooi described the game as a "technical hellscape" and called properly sandboxing mods "technically impossible in their current state." The developer characterized efforts to prevent malicious mod activity as a "hopeless arms race."

Mestiez stated that Workshop and mod support will only return if "mods are fundamentally safe to run," which "might never happen." The developer has released a new build that prevents mods from running entirely.

People Playground is not alone. Since the start of 2024, Steam Workshop has seen at least three other major malware incidents: malicious Project Zomboid mods in April, virus-laden Wallpaper Engine mods in June, and malware-infested Meccha Chameleon maps in July that led to a Discord hack.

The incidents highlight risks inherent to Steam's relatively open publishing model, which enables small developers to reach players but can lack the security infrastructure of larger studios.