This recent problem with Anego Studio's approach to mods and how they deal with internal problems, brings to light how much we can trust even indie software studios to self-police. Specially when it comes how they handle third party mods, and how much caution we have to exercise when using third party mods, run on indie games.
Personally, I was made aware of the malware code, when a music mod I was using in a private server with friends, caused everyone constant crashes.
As explained here by u/Latmei and with a very in-depth analysis of it here. Maltiez, an official developer of Anego Studio, introduced what by a large amount of cybersecurity companies(CrowdStrike, Kaspersky, etc) consider it is malware, in one of their mods.
We, as players and customers. Spent money, on not even a finished game software product. Expecting the developers and owners of said software product, to behave with transparency, honesty and integrity.
They had a Terms of Service for mods that forces the modders their own game to:
2- You warrant that the mod contains no harmful or malicious code, no material which is defamatory, bullying, offensive, obscene, or pornographic, and no breach of copyright of any other person.
5- A mod must have a clear explanation of its function in the English description.
The modder in question, and Anego Studio's Vintage Story affiliated and officially paid developer, broke these rules when they published the their mod. Without full disclosure of what actions said mod did.
And they did it with the full knowledge of the rest of the Anego Studio, and their tacit agreement on such practice, as per the screenshot in this post.
On top of being a breach of even their own ToS, not to even talk about the morality and ethics of such a thing. It is a huge breach of the player's trust.
Customers have and must never let, for companies to sell products or services that perform functions and actions that are undisclosed, hidden or worded in ambiguous and misleading terms. And even less to let them keep doing anti-consumer and anti-user practices. Specially in this landscape, in which players are treated like products to squeeze money off, instead of customers that support and allow them to work in this field.
Players come to indie games, fleeing from the enshitification and anti-consumer practices of such game corporations such as Electronics Arts, Sony, Ubisoft, Epic Games and other billion dollar corporations. Not to even mention of such other corporations like Microsoft, Google/Alphabet, Meta, Apple and so on, that have really set the gold standard, in how much they can get away with.
We hold contempt, frustration and anger against the aforementioned enshitification, anti-consumer practices and dark patterns that these companies and corporations employ. We do not want it to extend too, to even indie developers.
Finally, this is a warning for everyone. Any and all mods you download for any video game(Minecraft is a big example of this, as with Starsector or Rimworld), can and will have malware code that can not only affect your game, but your whole computer too. Be always vigilant of suspicious behavior after installing or updating any mod, in any game, and always.
Edit: For clarification. Said malicious code was found as it created a lot of "false positives" on mods that it was not the individual paid cheat mod described in the forensic analysis posted above. Otherwise no one would have found out that they let a fellow developer break their own ToS, and inject malicious crash code.
