Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Grish]

They knew we were downloading malware,priceless.

What a joke at this point.

Zero respect for this entire company 

[greed23]

Guys, stop blowing this out of proportion! Please! Listen, I know an official Anego employee made malware for the game he's working on! And listen, I know he hid that malware from the GitHub! And listen, I know he hid the crash behind another mod in the crash logs! And listen, I know he doubled and tripled down on it! And listen, I know his code was running on thousands of computers because he's one of the most prolific modders of VS! And listen, I know at least a portion of those thousands of computers were unintentionally targeted by this dev-created, mod-hidden malware, but this is really just getting out of hand!

[Meiiolri]

yep. the response as it is, is not a worst one.
Though not adressing the thing going on with Maltiez when the malware came to light, and his doubling down on the uploading version again after deleting it is a mistake.
the whole thing hit few good points, but it is lacking far more in others.
lack of addressing that Maltiez malware detected false positives in other mods is another issue unaddressed.
Keeping Maltiez on tighter leash, i do not know how to feel about this one. it won't rewind the damage he did up to this point, and it might lead towards more animosity.
I can say only future will tell how this will affect the Vintage Story and Anegos Studio.

[Stellarbone]

Yea with this lackluster response, not even mentioning the false positives, keeping Maltiez, I can't in good conscience keep playing or recommending the game to friends. 

[Venseer]

The response was fine and I couldn't care less to what happens to Maltiez but could you guys at least have the gut to acknowledge the code did stuff it wasn't supposed to and apologize to the affected mod developers and users that had problems due to it? To anyone reading this from outside they have zero idea of what problems this caused to users.

 

All the modders getting false error reports confused to what was happening and users trying to figure out why they were crashing until this came to light, this entire clown show wasted so much collective time out of the community you should at least ackowledge and apologize for it.

[Handbananasplit]

Not mentioning the false positives when they are the only reason any of us know about this is a choice I guess. Trust is broken, obvious lies in your mea culpa is crazy.

[Meiiolri]

Time will tell what will happen in the coming days and future.
as i mentioned in my previous response, some of most important parts of the whole ordeal were not adressed.
eh gotta see the next response (at least im hoping this will not be the last response of Anegos Team regarding the recent events.)

[ognar]

Simple fact that he took the bad code out and then put it back in makes it even worse. He knew what he was doing was wrong but the company being okay enough with that to keep him on will have repercussions since it can never be forgotten as long as he is there.

[Cicadas]

I want to continue to support Vintage Story and have done so by buying several VS keys (approx $330 worth) and distributing them via raffles on my community discord, now I no longer feel comfortable with further supporting VS. I want to see VS succeed and be the best it can, but I don't see that vision right now.

I am disappointed but not surprised. I do not think Tyron's statement and actions are sufficient. I do not think the Vintage Story Dev team comprehend the severity of Maltiez's actions, the Dev team's own inaction (or knowledge of what Maltiez did) or the bigger picture ramifications it presents. I think Anego Studio failed to address and effectively deal with the root of the problem, which was another pay-for-use (and its free-to-use variant) illegal mod being distributed to the community. I think Anego Studio withheld information of malicious code tied to one of their developers and failed to communicate, inform, educate and protect its community.

My trust in Vintage Story and Anego Studio has been significantly damaged as they have decided to keep Maltiez on the development team, to include their code contributions regardless of it being under more scrutiny. This incident and VS's actions onward will be something I strongly consider as I host Vintage Story vanilla and Modded for my community and the mods that are available in ModDB. Mods that run on my own server equipment, equipment that could be running malicious code in ways I have no immediate way of detecting.

A similar incident that reminds me very strongly of what VS is dealing with, is StarSector and how it was handle by their lead Dev, Alexander Mosolov.

Do better Anego Studio, learn from this mistake and do not ever repeat it.

1. What the real problem is, undisclosed malicious code execution distributed by ModDB crafted by a Vintage Story Dev.
2. VS/Anego Studio either deliberately or negligently withheld information about malicious code developed by a dev and deployed by their mods and showed a lack of ethics or judgement.
3. VS/Anego Studio failed to inform the community properly and take effective action.
4. VS/Anego failed to take proper actions dealing with an illegal pay for use mod.
5. A crisis/PR team is insufficient and not a solution, you need to genuinely address the problem of both bad faith and illegal mod makers. You need enforcement, auditing, and curation of modDB and stronger avenues of tackling TOS breaking mods. Otherwise vigilante code through mods is basically rubber stamped as "ok".

Relevant Topics:

-

Should Maltiez's mods be removed from ModDB

Yes. I do agree moving their mods to a custodianship is sufficient however I imagine it will put a strain on the VS Dev team till they find community trusted and reliable modders to take on Maltiez's mods.

Should Maltiez be banned from Vintage Story

Yes, effectively immediately and their development activities, to include their development contract with Anego Studios void. Maltiez should have no further ties now or in the future with Anego Studios.

What should be done about Maltiez' code and development contribution to the VS Dev Team and Vintage Story proper?
I think they should be removed completely and understand this will negative affect the combat update and development time. Scrutiny of the code must be intense, documented and open to audit. Communication after this should be transparent and clear.

 

[Stellarbone]

The cost of keeping Maltiez is the trust of the community. He's shown his hand, his only remorse was being caught. It's bad enough the dev team knew and Tyron didn't talk about any of the false flags or Maltiez's response in his official response, but keeping a lying ai techbro on the team is too much. 

Edited September 3 by Stellarbone

[HalfAxd]

3 minutes ago, Stellarbone said:

The cost of keeping Maltiez is the trust of the community.

Sorry, but no...  you are not the community and you don't speak for me.

If you don't like something, then you have the right to leave.

At this point the rabble rousing is beyond absurd.

Please say your peace and go.

[Nossin]

Where is the justice for players and modders who were falsely targeted?

What is stopping Maltiez from retaliating again?

[Diff]

Just now, Nossin said:

Where is the justice for players and modders who were falsely targeted?

Genuine question, what are you seeking here? What would you feel is appropriate compensation for your videogame crashing intentionally?

Just now, Nossin said:

What is stopping Maltiez from retaliating again?

He is no longer on the ModDB. He is no longer capable of uploading any mods at all. He is not and has never been capable of merging code into main directly.

[Eruannon]

Frankly I think it is high time I added my two cents here, as frankly I'd like to double check if I understood the statement by TyronX correctly.

1. Maltinez performed what could be argued illegal acts as per Directive 2013/40/EU, by adding malware to his library mods.
And yes, I am using Malware with full intent and meaning behind it - specifically code which intentionally interferes with whole or part of information system (in this case - client) without right (i.e. without user's authorization, as each and every single of those mods were listed as library mods, rather than anti-cheat mods, which is classic example of supply-chain attack, recently shown also in one of linux libraries, where additional payload was added after normal commits by same user), more than that - code was reportedly NOT included in official source files for the mods, making the deception and intent extremely clear.

Also - before this argument is used - no, 'but other mod was worse' is NOT an excuse in civilized world. Whitelisting of both users and mods is possible, and creation of mods that would facilitate it is possible as well. Vigilantism, unlike what comic books would like people to believe - is not legal in most, if not all, of Europe. 

2. Worse yet - Dev team KNEW of the illegal acts in question, at least partially, and never bothered to check if by chance the 'anti-cheat' measures don't cross from 'ok, good, let's address it' to 'dude, you are aware it's literally illegal right?'

3. Even given benefit of the doubt completely, and ignoring the point 2 for now - once the scope, scale and manner was made quite clear to the community, including Maltinez' own admission of it being effectively malware - the Anego Studios will STILL continue cooperating with known malicious actor, under supposed supervision (which already has failed given moddb was supposedly curated as well) on the main codebase, rather than just on mods [ironically - I'd be willing to make a claim that You have the reaction backwards. He should've been removed completely from main project first and foremost as known malicious actor, and maybe consider removing him from mod projects, as his own reputation would follow him, rather than other way around].

4. The official perspective of TyronX is that the execution in question (malware) is 'no big deal, as the correct targets were affected'. And here, I'd like to confirm, with TyronX preferably, whether his official stance is 'as long as correct targets were affected' it was fine with infecting large number of computers with malware via supply-chain attack, thus performing literal cybercrime, just because other malicious actors (with admittedly worse code effects, though again - we're talking malware here) were hit by it?

 

Whether Anego studio styles themselves as group of nerds or a company, it does not change the fact that as it stands currently - representative of the company/group is condoning criminal (malware distribution via supply-chain attack) acts, just because the excuse is noble. 

Honestly speaking I am fed up with how many people in various communities seem to consider that 'not a big deal', whenever this, or something similar happens. people try to excuse effectively criminal behaviour. Every single covert and semi-covert supply-chain attack begins as 'fix', 'security update' 'anti-tampering', 'testing kit' etc. Once the presence of such code is expected and stops being verified, the actual payload is then inserted, OR users get tricked into installing that update by claims of benign code. It baffles me, how much people give allowance to those actions, as long as the perpetrator gives good enough story to cover his back after they get caught. Usually by messing something up - such as here - giving a ton of false positives. It is especially egregious due to Maltinez being official part of the team working on the VS.

I will be watching further updates from the studio regarding the incident, and I honestly hope You get your stuff together and address the incident comprehensively. 'Tee heee, whoopsie' is not really acceptable response in my opinion, nor is 'yo he did good; he did it via malware, but he did it good, he got the worse guys', especially when we talk potentially criminal conduct as could be argued this incident is.

Edited September 3 by Eruannon
added 'just because the excuse is noble." to condoning section.

[HEX526174]

The way this currently looks? I want a refund tbh.

[Nossin]

4 minutes ago, Diff said:

Genuine question, what are you seeking here? What would you feel is appropriate compensation for your videogame crashing intentionally?

He is no longer on the ModDB. He is no longer capable of uploading any mods at all. He is not and has never been capable of merging code into main directly.

At minimum I would like Maltiez removed from the developement team so that there is not even a shred of a possibility of this happening again.

 

I do not understand what Maltiez is contributing that is so essential to keeping them on the team after doubling down on distributing malware.

[Cicadas]

I want to also thank members of the VS modding community and community at large for spotting Maltiez's malicious code and bring it to light to everyone. I look forward to other modders who take commitments to transparency, community building and safety strongly and forking away from Maltiez's mods. I hope the discussions here and in other forums and channels will remain respectful and that something genuinely good for the community as whole comes about and not the lackluster response that I am observing.

I also want to recognize a common statement in both the reddit and other threads is that Maltiez's actions have affected Vintage Story Dev's community trust and the reputation of other modders by Maltiez's mod false positive'ing other modder's mods, crashing and even bricking some user's games and saves. This is serious, this is severe. This was deliberate and a malicious mod, a malware no different than what I would have to had deal with in my prior profession. Keenly.
1. Maltiez's behavior and conduct in the discord in other forms of communication being utterly disrespectful
2. Maltiez's actions affecting VS/Anego Studios' reputation.
3. Maltez's mods false positives against other modder's mods * and negatively affecting their reputations too

I hope those unfairly banned will get reversed.

Edited September 3 by Cicadas
Clarified statement 3.

[Vratislav]

1 hour ago, MKMoose said:

Tyron has posted an official statement regarding the situation.

I honestly believe this is not final statement on the situation. There was explanation and apology that I personally consider mostly acceptable. Still, the clarification was not responding to the the case of false positives, whose victims should deserve specific apology or some kind of compensation (if possible).

The most important: there are promises that shall be fulfilled ("We will write clearer rules/disclosure standards for mods maintained by Anego team members"). For me, this is rational approach if these rules will be made public after they are defined. 

Although I see it will be not good enough for many. I am not very sure if there even exist a response that would satisfy people, who want see the blood. I understand that various VS players have various values and differ in judging particular actions. There are people who value quality of the game more, there are people who value honor and purity of all contributors, there are people who have strong belief in particular principles that were clearly breached. Just for this reason, not everybody may be even theoretically fully satisfied with any outcome of this crisis. 

Finally, whoever is confident that some criminal activity happened in this case, he has full right (in fact, he is even obliged) to make appropriate announcement to the law enforcing authorities. However I am not really sure, if such approach will lead to better outcome for the quality of the game.

[Cicadas]

This exactly, as many other comments. Eruannon, sums it up greatly.

Maltiez deliberately produced Malware and distributed through a community repository. This is incredibly negligent and harmful. Regardless of the severity or justification of the intent. In laymen term, it would be like poisoning or tampering your favorite soda with a mild annoying flavoring that some people are affected by, and some others could potentially have severe allergic reactions.

Beyond that, the ignorant responses or the permissive behavior to Maltiez's actions is just astounding. No person I've worked with would do something like this and get away with it, they would be fired immediately and removed from the team.

[Diff]

17 minutes ago, Nossin said:

At minimum I would like Maltiez removed from the developement team so that there is not even a shred of a possibility of this happening again.

 

I do not understand what Maltiez is contributing that is so essential to keeping them on the team after doubling down on distributing malware.

He's an employee. An employee can be a tricky thing to shed depending on your locality. Not everywhere allows you to snap employees out of existence at the drop of a hat. And the damage he can do is quite limited. You can't really sneak code like that past review, and every line of code (from any employee) is reviewed for behavior, correctness, and style. Apparently by Tyron himself. There really is no chance of it happening again.

Edited September 3 by Diff

[Cicadas]

Also to quote Tyron:

"As a result, all game servers using any of Maltiez’ 3 mods were effectively protected from malicious users attempting to use said cheat mod."

No they were not. It became another list item for me and my community admins, more development time from a server hosting perspective, of figuring out why certain mods were crashing. They did not protect my servers or my community from a would be boogeyman or modded hack client.

What genuinely has protected my servers and my community, is vetting and vouching for each other. Removing people who break our community rules. Self community moderation and building. Not vigilantism.

Edited September 3 by Cicadas
Clarifying the affect and response by my community admins

[Eruannon]

Just now, Diff said:

He's an employee. An employee can be a tricky thing to shed depending on your locality. Not everywhere allows you to snap employees out of existence at the drop of a hat. And the damage he can do is quite limited. You can't really sneak code like that past review, and every line of code (from any employee) is reviewed for behavior, correctness, and style. Apparently by Tyron himself. There really is no chance of it happening again.

Fun fact - there's such a thing as 'disciplinary termination of employment', in case of egregious violations, such as... malware distribution.

As per 'no chance' - please, I'd honestly appreciate if You at least made half-reasonable claims. npm, PyPi, Go and Packagist, few of bigger linux packages, far more widely used than VS, verified by multiple expert programmers, managed to be targets and vectors of supply chain attacks in 2026, but somehow, a one-person validation turns it into 'no-chance' for violations?

[Diff]

1 hour ago, Eruannon said:

npm, PyPi, Go and Packagist, few of bigger linux packages, far more widely used than VS, verified by multiple expert programmers, managed to be targets and vectors of supply chain attacks in 2026, but somehow, a one-person validation turns it into 'no-chance' for violations?

I could really reflect your request for half-reasonable claims here... These are not at all similar situations. NPM, PyPi, and Go are the exact same story as the ModDB. Entirely unreviewed by anyone except the users. Go is especially egregious to include because it doesn't even have a centralized repository of any kind, you can upload to any public URL on the entire internet as long as it responds the way the Go expects.

Linux distros are a closer analogy to this, and there are instances of maintainers going evil. But in the instances I'm aware of, they were trusted maintainers who didn't get their contributions reviewed at all, so we're back to being unreviewed here.

We're not talking about the ModDB, which Maltiez is no longer present on. We're talking about the main VS codebase. Every line of code that gets submitted to VS gets reviewed by Tyron. These are flatly not the same situations, so yes, a one-person validation turns it into "no-chance" by virtue of it being a binary difference between "completely unreviewed" and "reviewed by a minimum of one person but sometimes more." How are you going to smuggle "accidentally" setting ClientMain to null past anyone with functioning eyes, let alone eyes that are scanning for multiple criteria?

Edited September 4 by Diff

[Diff]

6 hours ago, lizardsprint said:

So you lied then, and my original claim was 100% accurate wrt him hiding it from the git repo. The source code never had AdditionalStuff.cs, because he hid it from the git repo, and it was only in compiled builds.

Wait a minute, I was saying this from my first post here, how did you even convince yourself I'm lying when I agreed with you? Meanie. >‍:(

7 hours ago, Diff said:

The additions were confined to one source file on top of what was checked into Git

Edited September 3 by Diff

[icesharkk]

I also do not support retaining maltiez on the VS team. I do not trust his judgement and his continued involvement is a supply chain risk. He's done significant damage to the brand, the user base, and to the trust the userbase holds in VS and that isnt going to go away while he remains. It is possible that its the Latvian employment legalities that are contributing to this but he needs to have no access to the code. 

It is also quite disappointing that Tyron conspicuously did not mention any of users or mods harmed by maltiez in the execution of his crusade against one cheat client/mod. This whole uprising you are seeing is about the harm and trust maltiez caused and broke. i have no little in the justification of why he did it or that it was successful. infact the idea that you would dedicate a significant portion of your official statement to justifying his actions and they fail to account for the collateral damage is staggering.  

three other discord communities that i participate in, that I didnt even know knew about this game have been calling it malwarestory for days. That sentiment cannot be cleaned with the malware author still employed. I cannot in good conscious tell them they are wrong while he remains. I WON'T tell them they are wrong while he remains.