Fire Maltiez

[AtomicWinter]

i simply cant trust any new updates while he works on this game

[icesharkk]

from the front page of the website: 

[icesharkk]

his reaction to this controversy was to cover it up, condemn those telling the truth as "spreading drama" and then to reintroduce the code to the mod out of spite. he shows no remorse nor understanding of why what he did was wrong. that is the sort of person who will violate rules, ethics, and community guidelines if he can think of a good reason to do so. I do not trust my computer to his personal view of good. i cannot trust him not to come up with more justifications for deviation in the future. 

I DO NOT CONSENT

[MKMoose]

As per Michaloid's (moderator's) words:

Quote

The case is being investigated and if you think that the moderation was biased and unfair or untrustworthy, then please send a support ticket on the site: https://www.vintagestory.at/support/

Otherwise, refrain from posting inflammatory content on the Forums.

 

Long story short for those not up to date below. If you need sources, you can look at the Discord server, but I frankly don't want to dig this up now.

Maltiez (author of several popular mods, recently joined the dev team) added code to Config Lib back in 2025 which detected usage of obfuscated DLLs and made the user client crash in various ways while obscuring the cause for the crash. This only affected multiplayer clients. The intended target was a cheat client by a user that shall not be named, and the method reportedly worked, as the cheat developer reportedly announced that they stopped working on the tampered client as they were unable to resolve the issues.

Since the targeting was done by checking for obfuscated DLLs, any mod that was also doing so would get detected as a false positive and its user's game would crash. This, according to Maltiez, only affected three mods, and the one that sparked most discussion as of 01.09.2026 was Caves and Caverns, whose developer found the cause ahead of Maltiez contacting them. The code that was causing the issue was since removed from Config Lib, so it is entirely safe to use with Caves and Caverns.

An additional source of contention was Maltiez' conduct following the incident, including briefly reintroducing the controversial code into the mod and dismissing some crash reports or genuine complaints as spam or deleting them from the mod's page due to being mixed in with spam.

Select discord moderators have also caught some flack for behavior which I would personally refer to as unproffesional. As of writing this most of the staff is out of office, and an official statement may be made after the next staff meeting.

Edited Tuesday at 07:35 PM by MKMoose
Add summary of the events.

[AtomicWinter]

he's shown his willingness to ad undisclosed and obfuscated code purpose built to crash your game and when confronted for this acted out of spite. WE. CANNOT. TRUST. HIM.

[icesharkk]

22 minutes ago, MKMoose said:

As per Michaloid's (moderator's) words:

Otherwise, refrain from posting inflammatory content on the Forums.

 

The TLDR for those not up to date, edited from this Discord message:

Maltiez (a modder for several popular mods, recently joined the dev team) added code to Config Lib, one of his mods, back in 2025, which detected usage of obfuscated DLLs and made the user client crash in various ways while obscuring the cause for the crash. This only affected multiplayer clients. The intended target was a cheat client by a user that shall not be named, and the method reportedly worked, as the cheat developer reportedly announced that they stopped working on the tampered client as they were unable to resolve the issues.

Since the targeting is done by checking for obfuscated DLLs, any mod that was also doing so would get detected as a false positive and its users would be kicked. This, according to Maltiez, only affected three mods, and the one that sparked most discussion as of 01.09.2026 was Caves and Caverns, whose developer found the cause ahead of Maltiez contacting them. The code that was causing the issue was since removed from Config Lib, so it is entirely safe to use with Caves and Caverns.

its not inflammatory to point our the malicious coder. no justification no matter how noble excuses the behavior. code from this author cannot be trusted ever again. he has demonstrated remorseless willingness to put his own ideals ahead of ethics, guidelines, and community trust. this time it was just anticheat. next time?

[Angius]

Now mods on the Discord are deleting messages lmao

Good going guys, protect the malicious modder and stay silent, ignoring and silencing the discussion about issues like that has historically never gone badly, right?

[icesharkk]

is the discord officially sanction or a community discord? i dont want to blame the studio for the actions of unsactioned moderators

[Teh Pizza Lady]

I'm not seeing the issue... he put anti-cheat into config lib. maybe don't use cheat software while playing a multiplayer video game? idk doesn't seem that hard a concept to follow.

[greatorder]

11 minutes ago, Teh Pizza Lady said:

I'm not seeing the issue... he put anti-cheat into config lib. maybe don't use cheat software while playing a multiplayer video game? idk doesn't seem that hard a concept to follow.

First off it shot off false positives, second it was undisclosed. This is kind of the equivalent of the horse meat scandal with Tesco's in the UK. There's not really anything wrong with eating horse meat, except if you happen to have an allergy or something to it, but when you're buying beef you're not after horse meat yeah?

It was malware. It wasn't horrific malware, it didn't keylog or record your IP or delete random files, but it was in there without people's consent and it caused problems. If people wanted anti-cheat mods, they'd install it themselves.

Most importantly, it was a breach of trust. I can't trust Maltiez to follow guidelines or do the right thing if he believes that he's got the right idea himself any more, because it turns out he'll go and do it regardless of other people's opinions. Sure it might be about as problematic as this one, but if he gets a bee in his bonnet about something more damaging, then it's potentially a *big* problem.

[icesharkk]

11 minutes ago, Teh Pizza Lady said:

I'm not seeing the issue... he put anti-cheat into config lib. maybe don't use cheat software while playing a multiplayer video game? idk doesn't seem that hard a concept to follow.

think of it this way. microsoft decides that they dont like that you use steam to circumnavigate their appstore and add delivery mechanisms. so the bake code into the windows ecosystem that causes steam to crash on launch after a certain amount of time. What maltiez did is the same as that he's just targeting a different demographic. you feel like its okay because its targetting cheaters. I do not care about the cheaters. i care about the fact that a mod author has decided what my computer will do without my consent. shipped in the release build and hidden his tracks. this time its against a "justifiable target" next time who knows?? i hope you ethics and justifiable targets always line up with this mod author because he wont be telling you before he puts the code on your computer. #leapordsatemyface

 

 

[Angius]

1 hour ago, icesharkk said:

is the discord officially sanction or a community discord? i dont want to blame the studio for the actions of unsactioned moderators

Tyron is the server owner, so...

[Teh Pizza Lady]

1 minute ago, icesharkk said:

i hope you ethics and justifiable targets always line up with this mod author because he wont be telling you before he puts the code on your computer.

 

5 minutes ago, greatorder said:

Most importantly, it was a breach of trust. I can't trust Maltiez to follow guidelines or do the right thing if he believes that he's got the right idea himself any more, because it turns out he'll go and do it regardless of other people's opinions. Sure it might be about as problematic as this one, but if he gets a bee in his bonnet about something more damaging, then it's potentially a *big* problem.

Ah, see my code of ethics doesn't care with the names involved, just what the action was and whether it benefits more people than it hurts. It is a type of Utilitarianism-type of ethics, sure, but the point is, yes it targets cheaters now. Tomorrow if it targets someone else, then it should be stopped. Seeing now that it caused negative impact for users of Caves N Caverns, I have to say it oversteps by a huge margin. I think Maltiez had good intentions, but executed it poorly.

[icesharkk]

11 minutes ago, Teh Pizza Lady said:

Ah, see my code of ethics doesn't care with the names involved, just what the action was and whether it benefits more people than it hurts. It is a type of Utilitarianism-type of ethics, sure, but the point is, yes it targets cheaters now. Tomorrow if it targets someone else, then it should be stopped. Seeing now that it caused negative impact for users of Caves N Caverns, I have to say it oversteps by a huge margin. I think Maltiez had good intentions, but executed it poorly.

yeah no that doesn't sit well with me. that set of ethics lets you equate the trolley problem into the organ transplat dilemma. the fact that maltiez is capable and willing to break this trust for his own preferences/ethics while masquerading as a trusted author means he can be trusted to repeat the behavior in the future.

I have no interest in spending more of my time policing his adherence to the already agreed upon rules. that's a waste of my resources, because he cant behave, that i have to expend because i have no clue when he is going to try to help the "greater good" again and decide maybe that transplanting one healthy person's organs to save 10 recipients benefits more people than it hurts. Turning all of the vintage story clients into a botnet to DDoS Russian datacenters supporting the war in ukraine benefits more people than it hurts he should be doing that too without informing you or getting your consent right? Or more relevantly people who cheat in vintage story cheat in other games too why stop the crashing at the vintage story client. he should set it up to brick their hardware so that they cant cheat in other multiplayer games too. that benefits more people than it harms as well.

the point of my drastic examples is to point out that there comes a point where the action is too great the be tolerated and that point is when it happens for the first time.

 

 

Edited Tuesday at 06:51 PM by icesharkk

[Teh Pizza Lady]

slippery slope much there?

By your logic, no territory or colony should have fought for freedom from the British Empire because if they could commit treason, then what else might they do?

[greatorder]

17 minutes ago, Teh Pizza Lady said:

 

Ah, see my code of ethics doesn't care with the names involved, just what the action was and whether it benefits more people than it hurts. It is a type of Utilitarianism-type of ethics, sure, but the point is, yes it targets cheaters now. Tomorrow if it targets someone else, then it should be stopped. Seeing now that it caused negative impact for users of Caves N Caverns, I have to say it oversteps by a huge margin. I think Maltiez had good intentions, but executed it poorly.

So if I yoinked money from you, without your knowledge, and gave it to charity? After all, more people are benefitting from it than you are.

[Teh Pizza Lady]

2 minutes ago, greatorder said:

So if I yoinked money from you, without your knowledge, and gave it to charity? After all, more people are benefitting from it than you are.

You didn't read the whole thing:

Quote

what the action was and whether it benefits more people than it hurts

Your logic doesn't hold up since stealing is illegal.

[icesharkk]

8 minutes ago, Teh Pizza Lady said:

You didn't read the whole thing:

Your logic doesn't hold up since stealing is illegal.

your inability to see the parallel here is staggering

14 minutes ago, Teh Pizza Lady said:

slippery slope much there?

By your logic, no territory or colony should have fought for freedom from the British Empire because if they could commit treason, then what else might they do?

we are not talking about taking personal risk to fight back against injustice. we are talking about putting others at risk to enforce his world view and behavior standards without prior consent. these are not comparable.

Edited Tuesday at 07:11 PM by icesharkk

[Teh Pizza Lady]

Well clearly you just want to engage in bad faith arguments so I'm dipping out. Read what I wrote. Read all of it. Try to understand it. I won't reply to further comments or mentions in this thread.

[icesharkk]

14 minutes ago, Teh Pizza Lady said:

Well clearly you just want to engage in bad faith arguments so I'm dipping out. Read what I wrote. Read all of it. Try to understand it. I won't reply to further comments or mentions in this thread.

thats unfortunate. if fewer people retreated when losing an argument the world would have a lot more cooperative discourse in it.

edit: bad faith arguments are not arguments that you disagree with or cant refute. the are arguments predicated on a faulty premise or that consist entirely of ad hominem or personal attack. saying they couldn't see the parallels is personal attack but it was frustration not the substantive portion of my argument. ergo it was not in fact a bad faith argument.

Edited Tuesday at 07:26 PM by icesharkk

[Stellarbone]

The problems are A) It wasn't just targeting cheats, and B) It was undisclosed. This isn't utilitarian, this is hiding. Untrustworthy. Not someone who should be on the dev team. 

[icesharkk]

so its fine that he breached our trust and run code on our machines without our consent because you knew about it in advance? im sorry no. without significant retraction and consequences i will not be endorsing vintage story moving forwards. this is is a completely f'd take by sekelsta.

 

edit: "furthermore this is a breach of the ModDB Terms of use page, Section 2 of Mod Uploads states: "You warrant that the mod contains no harmful or malicious code""

so sekelsta openly admits that Anego studios had prior knowledge of malicious code contained in one of the mod libraries in violation of their own moddb terms of use. Took no action. and is now claiming that it was okay because he didnt break the studio's trust? did i get that all right? or does another dev want to shove the foot further into their mouth?

Edited Tuesday at 09:48 PM by icesharkk

[Sugar]

Not only has this been a breach of trust from the team keeping the mod DB safe from malicious code, now that this individual represents the development of Vintage Story as a whole they NEED to be held to a much stricter standard than any other user. Regardless of the intent behind this particular piece of code, it was undeniably obfuscated to a level that very obviously indicates Maltiez was very aware of the potential reaction were it to be exposed. Now that the cat is out of the bag it is, in my opinion, in Tyron's ultimate interest to let Maltiez go. He should also give the rest of his team a stern talking to when it comes to PR in the future. Every Discord posting I have seen from this particular drama has been unprofessional at best and directly inflammatory at worst. A team needs a unified front. You can't have 5 different people all giving their personal opinions on the matter while the issue is still being resolved. Ridiculous. If Maltiez is not removed from the dev team soon I will likely be requesting a refund on the principle that I cannot trust a developer who would endorse the actions of someone who introduced a malicious mod to his users.

And in response to 'Teh Pizza Lady', this is not a debate on 'utilitarian ethics'. This is a game that we have purchased under the impression that the stewards of this product are acting in our best interests as clients/users. The argument of 'well just don't cheat lol' falls flat on its face when you consider this situation similar to the .xz hack not too long ago. Just because Maltiez's scope was, as far as we are aware, more narrow does not excuse or minimize the fact that they introduced malicious code into their mod. A library mod. One that other modders depend on. It obfuscates itself, crashes your game if you run mods that the mod developer doesn't agree with and is a perfect launching point for something much worse than that. It is NOT a single modder's responsibility to inject his own sense of ethics or restrictions into the game without the complete consent of those involved. This is malware, plain and simple, and it needs to be reacted to as such. The road to Hell is paved in good intentions and I, along with many other users, do NOT trust the trajectory of the game with someone like this directly contributing to actual game code rather than voluntarily installed mods.

Edited Tuesday at 10:09 PM by Sugar

[River Oak]

Not the first modder to add malware to his mod and he wont be the last. It's unfortunate that it keeps happening and I respect those with the knowledge to identify them and call them out.

[wimpb]

2 hours ago, River Oak said:

Not the first modder to add malware to his mod and he wont be the last. It's unfortunate that it keeps happening and I respect those with the knowledge to identify them and call them out.

The problem is that he isn't just a modder, if he was we'd just delete the mod or use a fork. He's now employed by by the official dev team. How can we actually trust the official builds of VS anymore? 

There's also something ridiculous about crashcode targeting mods that use obfuscating code, with the crashcode being obfuscated itself.