Regarding the impact of the crashcode put into ConfigLib and the needed clarification and explanation of the code for layman understanding

[The Lucky One]

I'm much more concerned about the cheating mod than Malt's actions... by which I mean that Malt's actions are not good and should not be encouraged. However, until the bigger issue of the cheat is addressed, I'm going to be holding off allowing forum members from joining my server (and "advertising" it as well), limiting access to trusted friends only.

[icesharkk]

3 minutes ago, The Lucky One said:

I'm much more concerned about the cheating mod than Malt's actions... by which I mean that Malt's actions are not good and should not be encouraged. However, until the bigger issue of the cheat is addressed, I'm going to be holding off allowing forum members from joining my server (and "advertising" it as well), limiting access to trusted friends only.

the cheat mod in question was just the most recent instance of this. and with the huge spotlight on this situation i expect there to a resurgence. I cant honestly recommend any server owner do anything except what your are planning or have dedicated in world moderation staff checking for cheat activities like they do in Rust. 

[KekkusMaximus]

30 minutes ago, IAmMoss said:

Yes. That is what is called an explanation. In no way does this glorify maltiez actions. Tyron literally calls these actions foolish. 

There is not a single line in the Reddit post from Tyron that calls what Maltiez has done either "foolish", "wrong", or something similar.

Tyron describes what Maltiez has done as essentially "taking matters into their own hands" and as a successful operation that protected the community without side effects because the code was purpose built to look only for the cheat mod and then crash the client that had it installed.
These are all things that we know for sure to be untrue.

Maltiez admitted to have written this code to mess with the cheat developers, not to protect the servers.
Other mod authors like Pr0fesseur (the author of Caves and Caverns) exposed the code as the cause of several crashes from clients that did not have cheats installed because the code didn't look for specific files but instead it looked for broader factors like obfuscated code and acted on those, directly causing non malicious mods to be affected.
When confronted about it Maltiez answered by saying that he basically did not care about other mods being affected as long as the cheat was too, later accusing the mod authors of being at fault because they published obfuscated code.

Tyron does not even mention any of these, and by painting a distorted picture of what has actually happened is directly endorsing what Maltiez has done.


EDIT, Addendum:

The only "error" that Tyron says was made by Maltiez was forgetting to pull the code from one of the 3 affected mods.
The only mistake that Tyron admits to have happened on Anego's side was to not actually check the code and then mishandling the PR issues that arose from the code being discovered a few days ago.

Edited September 4 by KekkusMaximus

[Diff]

2 minutes ago, Nossin said:

redirect the resources policing them back in to game development.

2 minutes ago, Nossin said:

Having the other devs constantly review and correct their work is frankly a waste of time.

It's actually standard operating procedure in just about any workplace. You review code for quality, for style, for bugs. Anyone can accidentally let a bug through or make a bad assumption that will bite later, and ensuring a consistent style is absolutely worth the effort in the long run, so you should always have at least a second pair of eyes passing over things.

Maltiez is definitely not a programming genius. Or a social one.

[Karidwen]

On 9/3/2026 at 7:37 AM, Teh Pizza Lady said:

As a software dev myself I can answer this.

First it's about trust. Maltiez is on the VS team, hired by Anego, to advise them on the combat update. When a company hires an individual and then the individual does something bone-headed while on the payroll, that person, being an extension of the company, actively harms that company by doing so. Maltiez lied by not communicating clearly what his code was doing, broke the ModDB TOS, and actively harmed people's gameplay by coding his widely-downloaded core library mods to have anti-cheat code in them that was falsely flagging mods that weren't being used for cheating. Maltiez broke that line of trust by his actions and while he is still employed by Anego, he is harming the line of trust that we have in the company to produce a good video game and deliver on their promises. If we cannot trust the employees, we cannot trust the company.

Second it's about the legality of what he did. Had he gotten approval from Anego via the proper channels instead of misconstruing what his code did either accidentally or deliberately and thus misleading the game devs about what it did, then his malware could be considered a feature. Many game companies have hidden malware in their code that breaks the game if you pirate it. It's very effective and hard to detect because the game still allows you to play somewhat but your experience will be harmed until you play a legit copy of the game. That said, Maltiez didn't get approval to do this. His code did not affect only the users of the cheat mod, it affected innocent bystanders. Two mod authors independently came to him because their legitimately obfuscated code was tripping his detection and breaking their mods. He whitelisted them and left the detector running for everyone else. At that point it stopped being a feature that misfired and became code he knew was hitting the wrong people and shipped anyway. That is not allowed and breaks a few laws concerning malware in different areas of the globe.

Third his attitude around the whole thing was lacking. He acted as if he had the right to make the decision to combat the cheat mod himself. His anti-cheat was targeted, and poorly at that, against a single known cheat mod. When eventually caught he was flippant, and even blamed the person who caught him out for ruining his work. He dismissed accusations with "Oh well, it worked so I'm happy." as if that solved the problem of the code existing in the first place and then when pressed, he relented and removed the code or so he claimed. He only removed it from a few editions that contained it, not all of them. ModDB moderators had to go through his released and pull many versions themselves. 

So not only did he lie to the VS team, he lied to us, broke laws, and acted like we were the problem, not him.

That is not the kind of dev you want on your team.

Thank you!

 

This is a spot on and very level headed view on the matter and I wholly agree.

What he did is also against laws in Latvia concerning cybersecurity and could be reported to Cert, the cybersecurity bureau.  Its not a good idea to do so as it will most likely harm Anego more, so im putting my trust that they will deal with the situation themselves.

[williams_482]

11 minutes ago, The Lucky One said:

I'm much more concerned about the cheating mod than Malt's actions... by which I mean that Malt's actions are not good and should not be encouraged. However, until the bigger issue of the cheat is addressed, I'm going to be holding off allowing forum members from joining my server (and "advertising" it as well), limiting access to trusted friends only.

Apparently the cheating mod is now defunct, although given the very public hubbub about all this, it's conceivable the mod author might try to resurrect it. Which would be a painfully ironic outcome for this controversy. 

This seems like a good time to mention the importance of backups for any server. A malicious user with a cheat mod can do all sorts of damage in-game, but once they are discovered and banned, rolling back to an undamaged backup will undo anything they did at the cost of some lost time. Not a perfect solution, but far better than alternatives. 

Edited September 4 by williams_482

[icesharkk]

3 minutes ago, Diff said:

It's actually standard operating procedure in just about any workplace. You review code for quality, for style, for bugs. Anyone can accidentally let a bug through or make a bad assumption that will bite later, and ensuring a consistent style is absolutely worth the effort in the long run, so you should always have at least a second pair of eyes passing over things.

Maltiez is definitely not a programming genius. Or a social one.

so what you are saying is the standard code review is sufficient risk management to account for the employment of someone who has already demonstrated the capability and motivation to circumvent Anego studios terms of Use and rules regarding the code quality/safety of their user base? 

Code review is only one part of proper risk reduction. another step in risk reduction is not employing personnel with a track record of lying, evading detection, and injecting malicious code. and doing so out of spite when called out by the community.

 

[KekkusMaximus]

4 minutes ago, williams_482 said:

This seems like a good time to mention the importance of backups for any server. A malicious user with a cheat mod can do all sorts of damage in-game, but once they are discovered and banned, rolling back to an undamaged backup will undo anything they did at the cost of some lost time. Not a perfect solution, but far better than alternatives. 

This is literally the only real solution to issues like this.

Backup the world, do it often enough and the most that you can lose from such an event is a server restart and a few minutes of gameplay.

I'm going to be blunt, but I'd take this over injecting malware into the game 10/10 times.

Also things like this are the reason why the server I have to play with my friends is self hosted, not advertised and whitelisted

[kuzimo]

In what way is it beneficial to keep him on the team? He's shown himself to be malicious and childish by gaslighting users of his own mod(s) and the community by claiming his mod(s) were causing no issues. This was not an "anti-cheat" as he likes to claim as it was a selfish vendetta against a supposed cheat, where are the people claiming that it has protected their server? I have seen no results from this, only negatives.

Why must I, or anyone really, go through countless hours of crash logs that are giving me false information because he was scrubbing them? and if I were to report it to him I would have been met with disregard and effectively been told to screw off. Makes no sense why he is still on the team.

[williams_482]

1 minute ago, kuzimo said:

where are the people claiming that it has protected their server?

If it had protected your server, how would you know? 

I don't think the kinds of trolls willing to pay for a cheat mod are inclined to do things like pop into public servers and say "FYI, I wanted to jump in here and ruin everyone's day, but the mod I used kept crashing my game so I guess I'll settle for playing legitimately."

[Karidwen]

On 9/3/2026 at 1:42 PM, Zaldaryon said:

Just an fyi, while it's what people think, there is no proof he was hired to touch the combat system. afaik I've read in the public Discord, it's not about combat at all.

The official post says he is on the team (whatever that means, could be employee, could be contractor) and is advising on the combat.

[LadyWYT]

2 minutes ago, Karidwen said:

whatever that means, could be employee, could be contractor

My general impression is that when it comes to scooping up mod authors to assist with development, it's generally a temporary contract for a specific update rather than a permanent position on the team. The individual in question may only be there to offer advice and not actually write the code or make assets themselves.

[KekkusMaximus]

3 minutes ago, LadyWYT said:

My general impression is that when it comes to scooping up mod authors to assist with development, it's generally a temporary contract for a specific update rather than a permanent position on the team. The individual in question may only be there to offer advice and not actually write the code or make assets themselves.

From what has transpired Maltiez is actually writing code for Anego regarding the 1.23 update. At least that's what I understand from Tyron saying that they will be kept under close observation about their contribution to the development of the update

[Karidwen]

On 9/3/2026 at 4:41 PM, Paruza said:

It's not useful because it's not the important part of this. I don't care what his motives were, literally at all.

What he claims his motives to be, cannot be taken at face value at this point. His actions are costing a lot of people a lot of time auditing his code, forking it, etc. To say nothing about the admins having to do extra work removing his mods and dependencies, cleaning up their worlds, debating this on forums. And the damage and efforts the dev team themselves will have to go through to resolve this situation as well.

Good point. 

We are discussing a lot about was it right, was ir wrong, what it did to games etc., but there is this part too.

Losses. Some will quit, some might try to reimburse game, some potential players might stumble upon this and decide not to buy the game, thats one part of the losses.

The other part is as Paruza said, team is going to use up time that would have otherwise be spent developing the game. Peoples time is the most expensive position in any business. And it will cost time and nerves to a lot of others outside VS dev team. All the modders that rely in any way on Maltiezs mods now will have to consider changes, as I will bet that a lot of the players will now steer clear of anything using Maltiezs stuff as we cant know what else he has added, if he felt like it.

[LadyWYT]

2 minutes ago, KekkusMaximus said:

From what has transpired Maltiez is actually writing code for Anego regarding the 1.23 update. At least that's what I understand from Tyron saying that they will be kept under close observation about their contribution to the development of the update

I've seen several people running around insisting that's the case, but I've not found any evidence to really support those claims. Not saying the claims are false either, just that I myself don't place much stock in them.

[Diff]

5 minutes ago, icesharkk said:

so what you are saying is the standard code review is sufficient risk management to account for the employment of someone who has already demonstrated the capability and motivation to circumvent Anego studios terms of Use and rules regarding the code quality/safety of their user base? 

Yes, that is what I'm saying. When you follow normal programming review processes, you can accept code from all of the malicious people on the world wide internet and be fine. Problems creep in when code is not reviewed, or there are certain kinds of subtle security bugs that can sneak past review if it's not careful enough, but those most apply to languages that aren't C#.

I wrote more about the risk profile we're actually talking about over here. tl;dr: He doesn't have direct commit access and the code he's working with doesn't like actually do much of anything. Click on the links inside that post, poke around the repository, you can see for yourself, there's nowhere to hide anything.

[Sparticus247]

22 minutes ago, icesharkk said:

so what you are saying is the standard code review is sufficient risk management to account for the employment of someone who has already demonstrated the capability and motivation to circumvent Anego studios terms of Use and rules regarding the code quality/safety of their user base? 

Code review is only one part of proper risk reduction. another step in risk reduction is not employing personnel with a track record of lying, evading detection, and injecting malicious code. and doing so out of spite when called out by the community.

 

You have every right to be angry, I just want to start with that, and I completely understand why you feel very strongly about this.

That being said, what Diff and others have said is valid as well, there really is no risk of him doing anything malicious to the VS codebase. I understand the reasons he did what he did to his mod library, but I also don't agree with it. I also understand that it was relatively benign, but also implemented it in probably the worst way possible, which also cost unnecessary hair pulling among server owners.

The studio has said they aren't terminating the relationship. They are terminating his stewardship of his mods that he spent so much time creating, and he will no longer be able to contribute mods in the future.

If you are still concerned that he's going to maliciously sneak things in the main code base after all this, and don't trust the studio at all, I don't think anyone is going to convince you otherwise. They have already stated they aren't terminating the relationship, so this is either something you can live with and keep playing the game and using mods, or you can move on.

Once again though you have every right to be upset about this, but I and others are also satisfied that this case is closed.

[Mushroomancer]

3 minutes ago, icesharkk said:

so what you are saying is the standard code review is sufficient risk management to account for the employment of someone who has already demonstrated the capability and motivation to circumvent Anego studios terms of Use and rules regarding the code quality/safety of their user base?

In this case, kind of, yes? Maltiez did not do anything particularly impressive to hide the killcode, from what I understand, it was there for plain reading as soon as people knew where to look and if someone else was reviewing that code before it was released, then it would have been caught. To pretend that Maltiez is going to be slyly pushing malicious code into the base of the game seems to disregard formal publishing processes.

On top of that, there is actually a difference between what Maltiez did and publishing malware that, say, steals bank account data or personal details or damages hardware/software by design. What Maltiez did was wrong, absolutely unethical and potentially illegal depending on what actually occurred and how much the fervor has exaggerated or staff have downplayed. It was ego-driven vigilantism, absolutely.

I don't think it's ideal to retain Maltiez, I generally agree that they should be sacked if for no other reason than they have shown a significant lack of regard for the community in both actions and words, however this entire greater conversation is starting to feel like temper tantrums with the name slinging and declarations that Vintage Story is now malware.

If your trust is so broken that you cannot believe that Anego will be able to handle this, then get your refunds and ward people away by all means. The issue is no longer about Maltiez for you at that point, it's about Anego as a whole and that's fine, that's your right. 

[Teh Pizza Lady]

19 minutes ago, LadyWYT said:

I've seen several people running around insisting that's the case, but I've not found any evidence to really support those claims. Not saying the claims are false either, just that I myself don't place much stock in them.

Anything can be true if you can't find evidence to refute it.

[Angius]

1 hour ago, Diff said:

And "provenance" is an easy word to type but an enormous beast of a problem technologically.

Sure it's not easy, but it's very doable. Offer a basic Github action that builds the code and submits it to moddb. Any mod submitted that way gets a nice little checkmark badge. That way, the binaries the players install are guaranteed to be exact to the code contained in the repo (which should be required to be public and at least source-available, if not open-source outright).

One of the issues with ConfigLib and other mods that had the malware in them was that the "anticheat" code was not present in the repo. 

[Diff]

1 hour ago, icesharkk said:

enable the ability publish mod libraries directly from github to moddb, or enable hash checking between the two and put a green check mark on the moddb page for mods releases that match their public github. no middle man injection opportunity.

I see this suggestion a lot, but it really wouldn't work. You compile the same code twice on two different computers, even twice on the same computer, you end up with two different DLLs. Just getting the code to compile is non-trivial and either wide open for abuse or harshly limiting to mod developers.

The security guarantees on that are also weak enough that I'd say they'd be worse than nothing, and certainly not worth the effort it'd take to make it happen. A false sense of security is worse than no sense of security.

[Khondza]

3 hours ago, Teh Pizza Lady said:

 

 

You have to look at unique downloads per version, which they don't show, but the total number of downloads misrepresents how many people actually downloaded it.

ah ok thank you i was unaware that's how the mod-db shows it. still i imagine its not a small amount of people who have downloaded these mods 

[Gandorf]

It affected any mods that had some level of obfuscation, which triggered a lot of false positives with probably more than just those two mods by all accounts, it was incredibly sloppy work 

The official response is terribly disappointing, and the fact that he is still employed when he broke EU laws is not a good idea and may expose devs to worse consequences. It might take a single person reporting it to the authorities, and the whole thing becomes nuclear

Edited September 4 by Gandorf

[KekkusMaximus]

44 minutes ago, LadyWYT said:

I've seen several people running around insisting that's the case, but I've not found any evidence to really support those claims. Not saying the claims are false either, just that I myself don't place much stock in them.

From the Reddit post by Tyron:

Quote

 

3. “How do we know this can't happen in Vanilla?”

To this day, as for the past 10 years, I still review all major code changes before they become part of the main game. Other team members also help me in that effort by checking that the contributed code is consistent, safe and of high quality.

None of the mods from Maltiez are or were planned to be integrated into the main game at any point in time. 

 

Quote

5. “What are you actually changing because of this?”
[...]
Maltiez will continue contributing to Vintage Story, but with oversight. 

Specifying that major code changes get personally reviewed by Tyron, that none of the mods by Maltiez were planned to be integrated into the main game and that going forward Maltiez will continue to contribute to VintageStory but with oversight leads me to believe that Maltiez is indeed writing code for Anego at least as part of their duties within the company.

Am I 100% sure? No. But to me that's the interpretation with the highest chance of actually being what is going on.

[Aresthor]

You should start banning people who perpetuate this drama. Good luck to all the Redditors from USA or wherever they live within their fantasy realms of moral high ground. Thinking they can get a court in The Hague to conduct a hearing for business malpractice over a publicly available, free modification. I hope you all leave us be; we don't want you. There is minecraft and lego for you, or even jenga. Go play that and leave us alone. Malware is when "obfuscated" "code" "malpractice". You have yet to develop an understanding of words and objects, let alone concepts in programming, or European Law concerning the sale and distribution of software. My call to moderation is to immediately remove these people from every server and forum, and ban them from the game. It does not differ from mass reporting, review bombing, or outright trolling in effect. They deserve no say in this, especially after all the "evidence" proving them to be wrong. Egotistic moralising of people who contribute nothing and consume FREE content greedily for this game, brought to you by kind modders who devote their time and life for the benefit of others, should not be heeded or encouraged. I guarantee 95% of the player base has not been affected. 
I hope your computers explode; Bill Gates pushes a Windows 11 update that will fry your computers so that we can never hear from you again.