Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[Diff]

2 hours ago, Vratislav said:

Caves and Caverns and VSRadio have about 5000 downloads together

??? 1367 (CNC) + 1314 (URL Radio) = 2681.

[Diff]

3 hours ago, Eruannon said:

Funny... official website's 'about us' (https://www.vintagestory.at/aboutus.html/) says something else.

Maltiez
Mod API Programmer

You know... perfect position to recreate the supply chain attack in main code with sufficient skill and intent by pretending the code is actively used for something else. It's not like e.g. npm didn't have similar problem.

These claims are confusing and very off-base. The Mod API is not the perfect position to recreate this in main code. It's really confusing that you would say this, because the Mod API would in fact be the single worst place for it. The API is mostly data types and glue, and it's all public on GitHub. Not much business logic you could hide anything in. If he's in the modding API, to be honest that's mostly going to be just documentation.

There's so little relation to supply-chain situations like NPM that I struggle to understand what possible connection you're drawing. I can see the connection when it comes to the ModDB. Anyone can upload any old nonsense to NPM. Anyone can upload any old nonsense to the ModDB. A fault in a dependency spreads through that. That makes sense.

It makes no sense to try and apply it to Vintage Story itself. Anything that enters VS's codebase undergoes code review by at least a minimum of Tyron, and a mix of others. When they review, they're looking for correctness, they're looking for style, they're looking for bugs. When the code you're supposed to be writing is just a list of available properties and plain-English explanations for what each is, it's going to be really obvious if all of a sudden you start scanning all loaded assemblies for matching CRCs and queuing up timers that submit random input events, disconnects, and crashes.

[Nossin]

1 hour ago, Diff said:

You're absolutely right, they would not have. But your thought experiment is not the reality they find themselves in and that does make a meaningful difference.

What difference?

If they were a consult then pay the rest of their contract and walk away.

If they're an employee then let them go for serious misconduct because their malware distribution continued up until recently through the mod Db owned by VS. By keeping Maltiez on the team, now Anego is also on the hook.

I'd also add a section for an employee performance improvement plan,  but we have multiple responses from Maltiev themself that they see nothing wrong with what they did, re-adding their malware, and have no remorse for the false positives affecting players that were a result of their malware.

The steps going forward were all things they were already doing. Except now maltiez gets free maintenance on their mods.

Honestly parting ways would have been best for everyone involved. Anego took steps to stop the problem, prevent it from happening again, and Maltiez would stop getting attacked.

instead, the devs either don't think its a big deal or they're rewarding malware distribution with a spot on the team. Maltiez is free to make a new account and start this whole bullshit again

[KekkusMaximus]

1 hour ago, Dilan Rona said:

I for one do not blame the devs of VS for what had happened.

I don't blame Anego for what Maltiez has done, I blame them for how they decided to handle it, which is essentially to not handle it.

1 hour ago, Dilan Rona said:

What everyone is forgetting is this is not an AAA company and cannot be held to the same standard. I'm literally seeing worse stuff coming from Sony, and Nintendo and all the other AAA companies that is a lot worse.

True, Anego is not a AAA company, but that doesn't mean that they get special treatment when they do something wrong that was easily avoidable. The fact that other larger companies do worse things does not excuse Anego when they do something bad and right now they're doing something bad both for us as a community and themselves as developers.

1 hour ago, Dilan Rona said:

But as far as I'm concerned, it's been dealt with.

It really wasn't tho.

Maltiez has not been banned, he "decided to depart the ModDB and Modding Discord" in accordance with Anego, that is not a ban, it's a half measure at best.
Maltiez's contract with Anego has not been terminated, even if what they did was not only extremely wrong but also possibly illegal according to european law. We don't know if they are going to work with/for Anego after 1.23 goes out but I believe they will.

This is not a worse case scenario, because Anego did not end up saying "Maltiez did nothing wrong" and some consequences have been enforced but it's certainly not a good ending either, I personally find these consequences (or lack thereof) rather disappointing.

 

Edited September 4 by KekkusMaximus

[Diff]

17 minutes ago, Nossin said:

Maltiez is free to make a new account and start this whole bullshit again

This is true regardless. Fired, hired, short of executing him there's no way to be safe from the spectre of Maltiez. It's the internet, you could be Maltiez right now. And there are people out there worse than him. Anyone on the planet could slurp up one of the many, many dead-but-popular mods with 10s of thousands of downloads, upload a REDUX version updated to 1.22, slurp up those 10s of thousands of downloads for themselves and steal everyone's bitcoinc. This is the nature of the moddb. It's the nature of downloading software off the internet.

Obviously, that doesn't mean we should do nothing when these cases are revealed. But if you're seeking safety, there was never any here.

17 minutes ago, Nossin said:

Anego took steps to stop the problem, prevent it from happening again, and Maltiez would stop getting attacked.

They have taken steps to stop the problem. It won't and can't happen again. His code is being reviewed, the code he's working on is low-risk and mostly documentation. I understand if you would rather them part ways, but practically there's no safety difference. Maltiez has been publicly tarred and feathered, he has lost control of all of his passion projects and, as anti-social as he can be, will likely never be able to re-engage with a community he spent a lot of time with. It's fine if you think that's not enough, or if you think things should be handled differently. I also think aspects should have been handled differently. But I disagree with your framing as simply free maintenance with no other consequence.

Edited September 4 by Diff

[Teh Pizza Lady]

5 hours ago, icesharkk said:

we can see how many downloads of the compromised configlib code occurred and a quick look shows its north of 300,000. i didnt bother checking the other two mods download counts 300,000 was way more than I thought and just staggers me. 

 

4 hours ago, Khondza said:

Config lib, imGui lib and Overhaul lib all total around 1,000,000 downloads

 

4 hours ago, Vratislav said:

Well, this makes virtually impossible to compensate everyone who downloaded ConfigLib (including, e.g. me on using it on singleplayer). Caves and Caverns and VSRadio have about 5000 downloads together

You have to look at unique downloads per version, which they don't show, but the total number of downloads misrepresents how many people actually downloaded it.

[Sparticus247]

8 hours ago, greed23 said:

"Use mods (that were created by the most prolific modder who is evidently trusted by the first party studio enough to be hired by them) at your own risk, people."

Its like people defending Anego right now are intentionally ignoring the fact that this isn't some random modder.  This was a dev, employed by Anego, putting malware in a mod for software he was working on.  This wouldnt be at all a PR issue for Anego if they did the right thing and fully fired Maltiez.  As of right now, they refuse to acknowledge the code meets the definition of malware and they've effectively done nothing but stop him from posting on the discord.

What I'm saying is I'm happy enough with the response, and I'm confident it won't happen again from this person based on what was laid out by The Official Statement.

I'm not out for blood, and maybe they'll fire him later and that's fine, but I'm satisfied that the problem is resolved and won't happen again from this crew. 

What I actually think will happen is someone will make something worse in a mod in the future. I've been in the industry long enough to see all sorts of supply chain attacks, and the way vintage story mods work gives way too much power on the local machine. They would have to drastically nerf how mods are allowed and used to stop this from being a real threat in the future.

This was just the wake-up call to really be careful. What if the next prolific modder who makes something that is used throughout the community gets their account hacked, and malicious updates get deployed to a new version of the mod, that actually does something legitimately harmful. I'm sure that will happen at some point and we will have to revisit this issue for a different side the same coin.

[Karidwen]

On 9/2/2026 at 9:46 PM, Khondza said:

From the looks of it they not only pulled the wool over those who downloaded the mod but the dev team themselves. Its a little funny to me because if they had just made a "target X hacked client anti cheat" mod they would have avoided all of this. If any of the Anego team is reading this i still trust you guys to make the right choices. The terms of use for the mod-db are the rules which govern to safety of those who use it, if it can be broken for the "right cause" or the "right people" it is worthless to us. Im not going to try and say what should be done, but if actions like this are allowed to continue on the mod-db ill probably just stay with vanilla. 

That would have been the morally correct solution, but Maltiezs actions draw a picture.

Add undisclosed code to his mod, which is intentionally hidden. - He CLAIMS it was done to only target specific cheat mods, this isnt proven.

The code is integrated in a popular mod, he knows this, people often auto update mods via VS installer, he knows this, no one reads each updated mods code or searches for issues. He knows this. - He knowingly and intentionally added code that becomes auto applied to wherever the original mod was installed, without the users consent or knowledge or any indication of what the updated mod does.

He INTENTIONALLY hid it. He made it so crash logs dont show what was the cause. - Tracks are being hidden.

 

Look, if there is a paid mod out there that can be used to destroy other peoples plays, make it known, give people a mod that specifically targets this. End of story.

Hiding code, not disclosing it, hiding its tracks, thats not good deeds, thats I do what I want and everyone who objects to what I do is an idiot (yes, there are screenshots of M calling people idiots for just not agreeing to his methods).

 

He started claiming it was against one bad actor, it was for the good of the servers etc., only now when this has been discovered and blown up in his face. Its claims. None proven. This doesnt mean people need to quit the game. What he is working on for Anego will certainly now be quadruple checked. What they decide to do with him is up to Tyron, but I wish they did not downplay what he actually did and make excuses that it was for good.

Tell it as it is. He added stuff to his mods, without informing people what the changed mod did, and he hid tracks of what it did. We know for a fact Maltiez is an agressive and rude person (see his replies to regular, normal, non rude questions under his mods about compatibility for example). His intent might not have been malicious, or it might have been ego driven malicious. It might be aimed at one bad mod, it might be aimed at mods of people he just doesnt like for whatever reason. We do not know. We do know that if he was not involved with Anego now, anyone elses actions like this with the mods they release/update would have been claimed to be malicious and breaking TOS. 
He is not in the right even if the claims of greater good are true. And there seems to be a lot of lies from his part on the issue which keep contradicting. He says it didnt effect servers, but then claims it was for the good of the servers. He says it was only effecting multiplayer connection games, but then whats the point, if the goal is to hunt down bad people who destroy others playing. Multiplayer together is used by friends, not random people on the internet. So either the hunting down malicious mod claim is false, or it only effecting multiplayer and not servers games is false.

[williams_482]

Ironically I think the reason this blew up so severely is that the damage was so minor and the motive relatively benign. 

If this malware had been an attempt to steal credit card info, for example, the reaction would have been immediate and extremely harsh. Anego would have immediately and publicly distanced themselves, shut down the affected mods and explicitly warned any users that they should be uninstalled, etc. More people would have been actually harmed, and there would still be ample concern about security problems, but there wouldn't be nearly so much rage floating around directed at Anego themselves. 

As is, the ambiguities about this situation (very minor accidental damages, from a foolish but well intentioned and effective action targeting an obvious villain) meant that Anego as a group was slow to figure out their preferred course of action, and individuals within the team had different opinions and ample opportunity to communicate those opinions publicly. This created a perfect environment for wild rummormongering. The people who both understood what was happening and felt most strongly about it loudly complained that nothing was being done, inciting a much larger group who didn't understand what was happening but did know that anything relating to malware is bad. Everything spirals wildly from there, including the usual cycle of "engage in righteous assholery -> get banned -> claim you got banned for the righteousness instead of the assholery" that dominates any controversy in moderated internet spaces. 

It's all a huge mess which mostly serves to highlight existing security problems that don't have easy technical solutions, putting us right back where we started but with more anger floating around. 

Edited September 4 by williams_482

[LadyWYT]

8 hours ago, Khondza said:

The only thing i could really expect to happen is maybe another post about the people effected "we are sorry about your servers crashing blah blah blah" the current response is just kinda "here is what happened here is what we are doing".

I mean I can see why Anego wouldn't be making a statement like that. Servers crash for a variety of reasons, and if they weren't aware of what Maltiez was doing they can't exactly do anything to stop something they aren't aware of. Saying something to the effect of "We're sorry your servers crashed" could possibly be taken as a legal admission of fault from Anego and drive a lot of players(more than are already currently doing so) to blame Anego for their servers crashing, when the actual cause is something else.

Likewise, "We're sorry your servers crashed" seems a rather condescending, sanitized way to put it, at least to me. It's easy to say "sorry" and not actually mean it, or try to use it as an excuse for not actually doing anything to rectify the issue. I'd much rather know what happened and what the devs are doing to address the situation and concerns, since that will produce some real results.

[Angius]

1 hour ago, Diff said:

They have taken steps to stop the problem

Which is, apparently, writing better guidelines. Which already existed in the form of TOS, which was wholly ignored by Malwaretiez. There are no technical solutions (provenance, scanning, whatever) proposed.

1 hour ago, Diff said:

he has lost control of all of his passion projects

Which he said himself he was already tired of maintaining. Also, the control of them was relegated to the VS team... which Malwaretiez is a part of.

[IAmMoss]

3 hours ago, Angius said:

Malwaretiez is still hired by them to work on the game in full official capacity. 

The whole official statement is weak and barely qualifies as a response. Not only was it not posted to the official forums, it also didn't mention the false positives, didn't acknowledge moderators tripping balls, claimed that Malwaretiez forgot to remove malware from ConfigLib where they removed and then re-added it... 

Tyron claims the Reddit post will be updated if he forgot anything. Well, it's been 12 hours now and no updates, so I think it's safe to assume they won't change anything.

To sum up: Tyron spent more time gushing over how righteous Malwaretiez was in their quest to thwart the bad chest developer, than he spent acknowledging issues, and Malwaretiez will be "punished" by being removed from the Discord (which they claimed was toxic anyway) and their mods (which they were tired with maintaining anyway) being transferred to Anego. 

i dont see where tyron was gushing about maltiez? all he really said was he had good intentions with his actions. yet still criticized everything he did, and how anego failed on their part not looking deeper into messages maltiez sent in a rolling chat. hes being removed from the community entirely, including the moddb. hes going to have his shoulder looked over while he works. Hes been all, but fired.

I'm sure there is some animosity between some of the devs and maltiez after this incident. The community is obviously extremely important to anego, and maltiez just made the whole company look bad.

Edited September 4 by IAmMoss
added a last sentence

[icesharkk]

it should also be pointed out that there is no official statement on Anego's website or forums. They put it on reddit where it will sit only until it is unstickied. so only people who are in the reddit or discord spaces and already drowning in the offopic channel have been notified officially. The majority of the customer base can only find out through this unofficial set of threads in discussion. Most people only pay attention to teh devlog/news forum and nothing else for games like this. Seems like Anego is hoping the majority of the player base never finds out. including anyone whos still running poisoned versions of those mods for older compatibility reasons. that doesnt sit right with me either.

[icesharkk]

5 minutes ago, IAmMoss said:

i dont see where tyron was gushing about maltiez? all he really said was he had good intentions with his actions. yet still criticized everything he did, and how anego failed on their part not looking deeper into messages maltiez sent in a rolling chat. hes being removed from the community entirely, including the moddb. hes going to have his shoulder looked over while he works. Hes been all, but fired.

Tyron didnt criticize maltiez, He spent 1/3 of the statement justifying the actions against the cheat author and painting it as successful. Then Tyron omitted any mention of users affected by false positives or users who had the code installed and didnt know it.

Edited September 4 by icesharkk

[IAmMoss]

2 minutes ago, icesharkk said:

it should also be pointed out that there is no official statement on Anego's website or forums. They put it on reddit where it will sit only until it is unstickied. so only people who are in the reddit or discord spaces and already drowning in the offopic channel have been notified officially. The majority of the customer base can only find out through this unofficial set of threads in discussion. Most people only pay attention to teh devlog/news forum and nothing else for games like this. Seems like Anego is hoping the majority of the player base never finds out. including anyone whos still running poisoned versions of those mods for older compatibility reasons. that doesnt sit right with me either.

i mean is that a fact tho? millions have downloaded this game. Where is the metric to prove most check devlogs? I know i do, but i also know of people who havent hopped on the website in the last 8 months. 

 

That being said, there should be a pinned forum post. Devlog and news should be strictly for update contents and plans like it always has been

[icesharkk]

53 minutes ago, williams_482 said:

...It's all a huge mess which mostly serves to highlight existing security problems that don't have easy technical solutions...

enable the ability publish mod libraries directly from github to moddb, or enable hash checking between the two and put a green check mark on the moddb page for mods releases that match their public github. no middle man injection opportunity.

[IAmMoss]

3 minutes ago, icesharkk said:

Tyron didnt criticize maltiez, He spent 1/3 of the statement justifying the actions against the cheat author and painting it as successful. Then Tyron omitted any mention of users affected by false positives or users who had the code installed and didnt know it.

i simply disagree. You can argue he wasnt harsh enough in his critcisms, but he was still critical. He was explaining why maltiez did do what he did, and also said it was a foolish thing for maltiez to do. explaining why someone did something isnt automatic justification. Like others have said, what could they even do to prove people claiming they were affected were affected? mentioning the crashing would have to come with an apology or the ones that want it mentioned would be upset, and could also be an admission of guilt which could lead to problems. 

[icesharkk]

1 minute ago, IAmMoss said:

i simply disagree. You can argue he wasnt harsh enough in his critcisms, but he was still critical. He was explaining why maltiez did do what he did, and also said it was a foolish thing for maltiez to do. explaining why someone did something isnt automatic justification. Like others have said, what could they even do to prove people claiming they were affected were affected? mentioning the crashing would have to come with an apology or the ones that want it mentioned would be upset, and could also be an admission of guilt which could lead to problems. 

 

Quote

As a result, Maltiez, of his own accord, decided to interrupt the effectiveness of this mod by adding code to 3 of his library mods (Config lib, PlayerModel lib, Overhaul lib) to detect the presence of this mod and only this mod, and if it was detected, caused the game client to crash. As a result, all game servers using any of Maltiez’ 3 mods were effectively protected from malicious users attempting to use said cheat mod.

"Maltiez decided to interrupt the effectiveness of this mod.... as a result all game servers using [his mods] were effectively protected from malicious users..."

queue the I Need a Hero Shrek montage

[SnapJelly]

I am personally not all that worried either but I don't think it is fair to say that people who are concerned are wrong for being so.

I can see both sides of the coin, I don't think a dev should be crucified for mistakes made that can be corrected, even if the ''mistakes'' were malware. People can learn, repent, improve, move on.

At the same time though it's fair for people to be concerned, if this turns out to be a behavior pattern that will repeat in the future it is better to get out then to stick around and find out if something like this will pop up again.

Personally rn, I'm on the forgiving side. Give them a chance to make up/do better in the future. But if other people don't have that take that is completely valid.

[IAmMoss]

4 minutes ago, icesharkk said:

 

"Maltiez decided to interrupt the effectiveness of this mod.... as a result all game servers using [his mods] were effectively protected from malicious users..."

queue the I Need a Hero Shrek montage

Yes. That is what is called an explanation. In no way does this glorify maltiez actions. Tyron literally calls these actions foolish. 

[williams_482]

If explaining why someone made a choice is taken to be tantamount to endorsing that choice, we are in a very dangerous place indeed. 

[Diff]

2 minutes ago, Angius said:

Which is, apparently, writing better guidelines. Which already existed in the form of TOS, which was wholly ignored by Malwaretiez.

Writing there, I was talking specifically about actions taken regarding Maltiez. The new TOS is for the ModDB as a whole, which Maltiez is no longer a part of. If Maltiez is no longer engaging in the ModDB, he also is not a member of the sub-group of Anego that is taking custodianship of his mods.

7 minutes ago, Angius said:

There are no technical solutions (provenance, scanning, whatever) proposed.

If you're talking about the ModDB here, which I think you are, I'm sorry to report that there really isn't a technical solution, it would have been dishonest of them to promise one. No scan would have ever caught what Maltiez did. And "provenance" is an easy word to type but an enormous beast of a problem technologically. One that would increase the maintenance burden of every mod developer substantially, while offering fairly weak guarantees that are easy to break or misunderstand, and massively increasing the scope of the ModDB beyond what any other game does. It would require Anego running their own automated build system, banning multiple types of completely-valid strategies for building mods just to keep their own sanity, and dealing with all the abuse and maintenance burden that entails. Again, all while offering very weak protections. Be happy to yap more about that but I think this post is long enough for now.

[Zaph42nd]

The whole situation is unfortunate but I think a sign of growing pains, eventually every community and game will encounter this issue as it's just part of what moddable games bring imo.... Now the issue is I think that both parties, community and Anego Studios, were not equipped to handle the situation and that caused more controversy than it should've (I think community response was overly harsh (specifically dev in question is contracted out, not contributing directly to the game. That presents its own challenges I'd imagine) but it was reactionary to an equally reactionary moderation team who wasn't equipped to handle the situation). As to the response, I think it's measured since vanilla code isn't being impacted and mods aren't getting integrated into the game, but I do agree at least to some degree this should spark some changes to how Vintage Story ModDB is handled, more moderation and oversight couldn't hurt. You know it reminds me in a lot of ways of the situation that happened a few years ago with Starsector, very similar issue happened in that community but they did eventually make a recovery (albeit some bad-blood still exists for players but that's always going to be the case)

[Nossin]

2 hours ago, Diff said:

They have taken steps to stop the problem. It won't and can't happen again. His code is being reviewed, the code he's working on is low-risk and mostly documentation. I understand if you would rather them part ways, but practically there's no safety difference.

You can eliminate the risk entirely by removing Maltiez and redirect the resources policing them back in to game development.

Is Maltiez some kind of coding genius worth protecting? Based on their own statements, they only care about what works with no regard for players and modders because "Trust is not part of the equation here". How does someone like that meaningfully contribute to development? Having the other devs constantly review and correct their work is frankly a waste of time.

Just tell me that Maltiez is critical to the game development going forward, that condoning the malware distribution, giving the finger to players and modders who were triggering the malware's false positive, banning players who were trying to figure out why a dev was targeting them is worth the price.

Edited September 4 by Nossin

[icesharkk]

16 minutes ago, IAmMoss said:

Yes. That is what is called an explanation. In no way does this glorify maltiez actions. Tyron literally calls these actions foolish. 

7 minutes ago, williams_482 said:

If explaining why someone made a choice is taken to be tantamount to endorsing that choice, we are in a very dangerous place indeed. 

Its the spin on the explanation that I am uncomfortable with. especially in the context of the rest of the post that doesnt address the ways his action negatively affected the community. Nor does effectively address consequences. Maltiez already stopped working on the majority of his mods by this point, there ae forks and refactors out for configlib now, tyron already oversees all code commits so that s a nothing consequence, and Maltiez keeps his intellectual rights.