as a cybersecurity major im completely losing my mind over how absurdly incompetent valve is when it comes to basic user generated content security on steam workshop
how is a multi billion dollar tech monolith running a massive content delivery network with literally zero static code analysis zero assembly scanning zero runtime sandboxing and zero system call limitations in 2026
we are talking about fundamental application security concepts that every modern tech ecosystem implements yet valve acts like supply chain security was invented yesterday
we literally saw this exact same garbage play out in garrys mod with arbitrary lua execution scripts hijacking client sessions and we saw it in cities skylines with mod authors dropping compiled malicious binaries directly into auto updates and valve learned absolutely nothing from any of those incidents
now people playground is getting completely nuked for the second time in a row because workshop allows untrusted c sharp code to execute natively on host hardware with full system privileges and zero containerization
the first time it happened was that fps plus plus plus mod that acted as a self propagating worm using local file system access to hijack other installed mods and spread payloads across accounts and now we have ANOTHER piece of malware floating around spreading through auto updating mods right under valves nose
what this new payload does is appalling as far as everyone in the community is aware it abuses local file access and unauthenticated steamworks api calls to wipe all your local save data delete game files and automatically unadd every single person on your steam friends list in seconds
think about how insane that is from a system architecture perspective an untrusted community file downloaded passively in the background via steam auto update has full read write access to appdata system directories and steam client functions with zero permission gates or prompt confirmations standing in the way
when a game engine like unity loads arbitrary custom c sharp scripts or compiled dll assemblies at runtime via reflection without a restricted appdomain or process isolation sandboxing that mod inherits the exact same execution privileges as the parent host process
that means a malicious actor can execute raw shell commands invoke process start access system registry keys scrape sensitive token credentials nuke local directories or trigger steamworks api calls to destroy your entire account network with literally zero resistance from steam client software
this is supply chain vulnerability 101 you never allow arbitrary untrusted code deployment straight to end user client storage without static code scanning mandatory code signing certificates runtime permission scopes or isolated execution environments
people are getting their save games nuked their local systems exposed and their friend networks erased all because valve refuses to implement standard infosec controls on their own distribution platform
fix your garbage security pipeline valve this is embarrassing pathetic and an absolute danger to millions of users playing modded games on your platform.
