>GUNDAM ROGUE ORBIT launches on March 5th, 2027!

>Become the pilot you were born to be. Change humanity’s fate in GUNDAM ROGUE ORBIT, a high-mobility action game that delivers a bold new take on Gundam, blending a fast-paced cinematic story with intense, hard-hitting combat in an all-new universe.

>Become a Nephilim and descend into the fallen city of Gildenarch in Crimson Moon, a gothic action-adventure RPG playable solo or in 2-player online co-op.

>Master brutal, tactical combat. Discover powerful weapons and gear. Shape your build. Face the horrors lurking within the Wards and challenge the Dead Gods that await.

>Collect artifacts, reach an extraction point and be careful of the Sludge watching!

>This time, the monstruosity has a new ally: Goblins. Just what your new weapons need to cut their teeth

>Have fun Commandos!

It was recently discovered that Maltiez, a developer on the survival game Vintage Story, and creator of several popular Vintage Story mods, hid malware in one of his most popular mods. At the time of writing, his mod 'Config Lib' has over 650k downloads, and is a prerequisite for a multitude of other Vintage Story mods.

Config Lib contained intentionally hidden malware, which crashes your Vintage Story client if it detects that you are using it in conjunction with mods that Maltiez considers "cheating," as well as other mods unrelated to cheating, such as one that adds a radio to the game. This was discovered when the creator of 'Caves N Caverns,' a mod which simply tweaks the caves within the game, discovered that Config Lib caused Vintage Story to crash and cover its own tracks if used alongside their mod.

This is a more detailed explanation of how the malicious code in Config Lib functions and disguised itself:

"The code is concealed inside library code under the YamlDotNet.Serialization namespace and executes through a [ModuleInitializer]. The initializer automatically registers an event handler when the assembly is loaded.

The implementation:

1. Activates only when running as a multiplayer client.

2. Enumerates all assemblies loaded into the application's AppDomain.

3. Fingerprints loaded assemblies using hard-coded CRC32 values.

4. Performs an additional heuristic check for obfuscated assemblies by measuring the percentage of type and member names shorter than three characters.

5. When its detection conditions are satisfied, schedules execution after a pseudo-random delay.

6. Deliberately modifies unrelated internal Vintage Story client state in ways capable of causing crashes, disconnects, broken networking, corrupted UI state, and other intermittent failures.

7. Silently catches and discards exceptions throughout the detection path, making the resulting failures substantially more difficult to diagnose.

These operations have no apparent relationship to configuration loading or YAML serialization. The method performing them is misleadingly named ReloadFromConfigs. The behavior is also conditional, delayed, randomized, and targeted based on characteristics of other loaded assemblies. This causes the resulting crashes and disconnects to appear intermittent rather than producing an immediate deterministic failure.

This appears to fall directly within NuGet.org's prohibited-use policy, which prohibits packages that contain malware and, independently, packages “designed to harm a developer's workstation or their organization.” It also appears to violate the NuGet.org Terms of Use prohibition against posting harmful data capable of harming or disrupting another user's computer."

When all of this was discovered, Maltiez removed the malicious code from Config Lib, and then immediately reinserted it, seemingly out of spite. He has now removed the malware again because it "fulfilled its purpose." See here.

As previously stated, Maltiez is employed as a developer by Anego Studios (as seen on Vintage Story's 'About Us' page here, archived here)

Now that this has begun to come to light among the Vintage Story community, Maltiez has since issued a statement admitting that he inserted malware into his mod, and apologizing for not disclosing it. Despite the apology, he has gone on to state that he "knows he did the right thing, and it worked." (Seen here)

After an initial "official" statement was made by a moderator of the Vintage Story discord, stating that the situation was "blown way out of proportion" and to "move on" (here), other members of Vintage Story's dev team seemed to indicate that they have been aware of the malware for months (seen here).

The CEO of Anego Studios, Tyron, has since issued a statement (here), saying that they will take a close look at the situation, but to "please trust [their] process."

“We have decided to remove Stones Keeper: King Aurelius from Steam. The game will be removed from the store on September 14, 2026. Until then, you can still add it to your library. After it is removed, the game will remain in the libraries of everyone who added it, and it will still be playable through Steam.

There are two simple reasons for this decision:
On September 14, 2026, we’re releasing Stones Keeper: Director's Cut.

Over the course of developing the Stones Keeper series, we have significantly reworked and improved many of its gameplay mechanics, graphics, interface, and other elements. Stones Keeper: King Aurelius no longer meets the quality standards we now have for the series.
“