What happened
- On September 22, Studio Minus—the developer of ragdoll torture sandbox People Playground—posted a Steam news update saying it had disabled the game's Steam Workshop support "due to yet another malicious mod," which the developer said was "especially bad"
- The developer has since released a new build of People Playground that prevents mods from running, saying on its Discord that Workshop and mod support will only return if "mods are fundamentally safe to run," which "might never happen"
- A redditor who inspected the malicious Workshop mod claims the mod hijacks the user's Steam account to republish itself on the Workshop along with the user's personal information, destroys files for People Playground and other installed Steam games, and sends slurs to the user's Steam friends
- Despite initially claiming that the infected mod "does not steal passwords" or other credentials, Studio Minus is urging People Playground users to change their Discord passwords as soon as possible, as well as "the passwords of all your important accounts"
- This is People Playground's second Workshop malware incident this year: Studio Minus previously disabled the game's Workshop after a similar outbreak of self-replicating malware in February
At this point, you're playing People Playground at your own risk
And Studio Minus seems to agree. In a blog post from last month, zooi—People Playground's primary developer—called the game a "technical hellscape," which makes it "technically impossible to properly sandbox mods in their current state." While the studio claims that the software has measures in place to prevent malicious mod activity, zooi called it a "hopeless arms race."
When a studio's developer doesn't seem confident about the viability of their project's security measures, you shouldn't either. But while People Playground seems like a particularly intense dumpster fire, 2026 hasn't inspired much confidence in the safety of Steam Workshop overall.
Since the year started, we've seen at least three other cases of Workshop-related malware incidents: first malicious Project Zomboid mods surfaced in April, then virus-laden anime ladies emerged in Wallpaper Engine in June, and then malware-infested Meccha Chameleon maps led to its Discord getting hacked in July.
It's the double-edged sword of Steam's relatively open publishing platform. We get to enjoy a bounty of games from small developers—but they can't always offer the same expectation of software security as their more established counterparts.
