[PSA] Everything Known about June Workshop Incident

[javiertc]

[PSA] Everything Known about June Workshop Incident

UPDATE 25/09/2022: These 3 new malicious addons are banned!

This is a summary of everything that is known about June Workshop Incident.

DISCLAIMER: All the knowledge found here has been obtained by reading many posts about what happened and watching youtube videos about what happened. Not everything can be 100% true since you should also ask the creators of addons.

Explanation:

Some workshop modders have been updating their addons with malicious (non-virus) code, including NSFW content, jumpscares and adware/cryptomining.

Almost everyone made this to troll the community or get revenge for something (some of them have comments in their code insulting Steam, Valve, Gabe Newell, Garry...)

Known Malicious Addons:

Instead of using the profile URL, I'm using their SteamIDs because some of them are constantly changing the profile. Use a SteamID Finder to find the profile.

This addons are known for having a jumpscare/goatse/cryptomining/adware thing. The addons are orderer chronologically:

• Rufus:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3371530631540085235/
    
  • Date: 24/09/2022.
    
  • Type: NSFW + Data Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2856526441.
    
  • Owner: 76561199066088023.
    
  • Status: Banned.
    

• Remove Sandbox Velocity Cap:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3371530631540085235/
    
  • Date: 24/09/2022.
    
  • Type: NSFW + Data Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2857172809.
    
  • Owner: 76561199066088023.
    
  • Status: Banned.
    

• NEXTBOT Health Bars + Health Settings:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3371530631540085235/
    
  • Date: 24/09/2022.
    
  • Type: NSFW + Data Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2851214628.
    
  • Owner: 76561199066088023.
    
  • Status: Banned.
    

• PET MELON:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414308028644267049/
    
  • Date: 12/07/2022.
    
  • Type: Backdoor.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2249106100.
    
  • Owner: 76561197960300444.
    
  • Status: Banned.
    

• Vulture Wings [Reuploaded]:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414307257846555768
    
  • Date: 01/07/2022.
    
  • Type: Cryptomining/Adware.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2824856126.
    
  • Owner: 76561198173486745.
    
  • Status: Banned.
    

• Futuristic Armor with PowerUPS (Sci-FI) [Cyberpunk]:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414307257845968117/
    
  • Date: 01/07/2022.
    
  • Type: Cryptomining/Adware.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2811693801
    
  • Owner: 76561198203264812.
    
  • Status: Banned.
    

• Map Material Tool:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414307257845968117/
    
  • Date: 01/07/2022.
    
  • Type: Cryptomining/Adware.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2816272533
    
  • Owner: 76561198203264812.
    
  • Status: Banned.
    

• Talking Ben's House:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414307257842148059/
    
  • Date: 30/06/2022.
    
  • Type: Jumpscare.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2777926325
    
  • Owner: 76561199075581469.
    
  • Status: Banned.
    

• male007 pack + playersmodel:
  
  • Explanation: https://steamcommunity.com/app/4000/discussions/5/3414306773852580475/
    
  • Date: 27/06/2022.
    
  • Type: Adware.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=1489890477
    
  • Owner: 76561198265111219.
    
  • Status: Banned.
    

• Food SWEPs Pack:
  
  • Date: 26/06/2022.
    
  • Type: Jumpscare/NSFW/Garry's Mod Data Folder Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2816948514.
    
  • Owner: 76561198059485892.
    
  • Status: Banned.
    

• Smart Interaction:
  
  • Date: 26/06/2022.
    
  • Type: Jumpscare/NSFW/Garry's Mod Data Folder Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2818916773.
    
  • Owner: 76561198059485892.
    
  • Status: Banned.
    

• Realistic Player Speed:
  
  • Date: 26/06/2022.
    
  • Type: Jumpscare/NSFW/Garry's Mod Data Folder Remover.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2818933771.
    
  • Owner: 76561198059485892.
    
  • Status: Banned.
    

• Tall Construct Map:
  
  • Date: 23/06/2022.
    
  • Type: Cryptomining/Adware.
    
  • Workshop Link: Unkwown.
    
  • Owner: Unkwown.
    
  • Status: Banned.
    

• Lighting Magic:
  
  • Date: 23/06/2022.
    
  • Type: Cryptomining/Adware.
    
  • Workshop Link: Unkwown.
    
  • Owner: Unkwown.
    
  • Status: Banned.
    

• Trollface Playermodel:
  
  • Date: 03/06/2022.
    
  • Type: Jumpscare/NSFW.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2203246561.
    
  • Owner: 76561198163385489.
    
  • Status: Banned.
    

• Ambient Occlusion:
  
  • Date: 03/06/2022.
    
  • Type: Jumpscare/NSFW.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2587458626.
    
  • Owner: 76561199106327998.
    
  • Status: Banned.
    

• View Extension (Thirdperson & Firstperson):
  
  • Date: 03/06/2022.
    
  • Type: Jumpscare/NSFW.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2589006389.
    
  • Owner: 76561199106327998.
    
  • Status: Banned.
    

• Action Extension:
  
  • Date: 03/06/2022.
    
  • Type: Jumpscare/NSFW.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2592662319.
    
  • Owner: 76561199106327998.
    
  • Status: Banned.
    

• Glue Library Tool:
  
  • Date: 03/06/2022.
    
  • Type: Jumpscare/NSFW.
    
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2588410453.
    
  • Owner: 76561199106327998.
    
  • Status: Banned.
    

Non-Malicious Addons:

Some people are saying that these addons are malicious, but they aren't.

• gm_mallparking:
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2619660952.
    
  • Reason: Random people saying that this addons has goatse without showing proofs, Just to create more confusion and fear.
    

• Stormfox (1 and 2):
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=1132466603 and https://steamcommunity.com/sharedfiles/filedetails/?id=2447774443.
    
  • Reason: Random people saying that this addons has goatse without showing proofs, Just to create more confusion and fear.
    

• Seat Weaponiser II: Better Vehicle Bullets:
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=2823672379.
    
  • Reason: Random people saying that this addons has goatse without showing proofs, Just to create more confusion and fear.
    

• [SRD] Base:
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=1258957025.
    
  • Reason: The user 76561198059485892 (Jumpscare/NSFW/Garry's Mod Data Folder Remover) was in this addon as co-owner (now is not a co-owner). Also this addon haven't had an update since 2019.
    

• PCMod 15 [Fixed] + UPDATED:
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=612756292.
    
  • Reason: The user 76561198059485892 (Jumpscare/NSFW/Garry's Mod Data Folder Remover) was in this addon as co-owner (now is not a co-owner). Also this addon haven't had an update since 2017.
    

• S.T.A.L.K.E.R Detector Sweps V2:
  
  • Workshop Link: https://steamcommunity.com/sharedfiles/filedetails/?id=697092267.
    
  • Reason: NA. Also this addon haven't had an update since 2016.
    

What you should do if you have an malicious addon:

If you are subscribed to an addon of this list, unsubscribe it, open Garry's Mod and enter in the console

menu_cleanupgmas

If you are not subscribed to an addon that is listed here, filter your subscribed addons by update date (Workshop > Your Files > Subscribed Addons > (Right side below your profile image, where it says "Subscription Date") change it to "Update date"). If an addon have updated recently, it has a high chance of being malicious (but not 100%, you should test it or share it with other people on Reddit/Steam Discussions for them to check it).

Tips to Avoid Malicious Addons:

Unsubscribe from addons you no longer use:

This will reduce the chance of having an malicious addon.

Check your list of subscribed addons:

There is an option where you can sort all your subscribed addons **by updated date**. If you see a recently updated one, be carefull, check the addon's comments and/or search on Reddit/Steam Discussions to see if it's malicious.Workshop > Your Files > Subscribed Addons > (Right side below your profile image, where it says "Subscription Date") change it to "Update date".

Clean all GMAs when opening Garry's Mod:

Add this line in your Garry's Mod launch parameters:

+menu_cleanupgmas

This will remove all GMAs from addons you recently unsubscribed or addons that are banned everytime you open Garry's Mod. If you are lucky and you have an malicious addon that has been banned, this will remove it and probably save you from seeing a goatse/jumpscare.

Be carefull using reuploaded versions:

Most of them (hopefully) reuploaded a non-malicious version, but probably someone will upload an malicious version just to troll more people. Be carefull.

[Fearagen]

If I had enough steam points, I'd give an award, this is pretty well made. Hope this blows up and stays at the top of the forum. Edit: seems like some people have given awards. Edit2: Gave a award.

[javiertc]

Originally posted by Fearagen:

If I had enough steam points, I'd give an award, this is pretty well made. Hope this blows up and stays at the top of the forum.

Thanks you!

[Attention Horse]

But the real question is: Why did this even started in the first place?

Why are people all of a sudden feel mad and need to take these extreme actions just to ruin someones day and get themselves banned?

If they continue down this route I swear they will update this game by removing most of the lua features, limiting addon creation just to stop these guys from spreading this crap. (highly unlikely but something will be done and it's not gonna be pretty, both for them and us.)

[M1L4N18]

This situation is really weird

[дэд󠁳⁧⁧ байтс]

I am quite surprised that I have avoided Food SWEPs Pack jumpscares and data deletion.
must've been lucky to not play GMod when it got updated!

[Javierx1]

Padrea más si eso

[Attention Horse]

Also guys, is anyone subscribed to this addon:

https://steamcommunity.com/sharedfiles/filedetails/?id=2636289143

Disabled comments on both addons page and on his profile is kinda worrying, and it was updated 2 days ago.

[ArcticTwister]

Originally posted by Mrufkieniec:

I am quite surprised that I have avoided Food SWEPs Pack jumpscares and data deletion.
must've been lucky to not play GMod when it got updated!

me too man im lucky as well

[javiertc]

Originally posted by Attention Horse:

Also guys, is anyone subscribed to this addon:

https://steamcommunity.com/sharedfiles/filedetails/?id=2636289143

Disabled comments on both addons page and on his profile is kinda worrying, and it was updated 2 days ago.

I can take a look if there is something or not

[Fearagen]

Originally posted by javiertc #SAVETF2:

Originally posted by Attention Horse:

Also guys, is anyone subscribed to this addon:

https://steamcommunity.com/sharedfiles/filedetails/?id=2636289143

Disabled comments on both addons page and on his profile is kinda worrying, and it was updated 2 days ago.

I can take a look if there is something or not

I would take a look, seems suspicous that he would all of a sudden kill comments. His feedback place.

[javiertc]

Originally posted by Attention Horse:

Also guys, is anyone subscribed to this addon:

https://steamcommunity.com/sharedfiles/filedetails/?id=2636289143

Disabled comments on both addons page and on his profile is kinda worrying, and it was updated 2 days ago.

Well, I have just decompressed that addon and everything seems fine. I didn't see anything ofuscated or suspicious.

[Attention Horse]

Originally posted by javiertc #SAVETF2:

Originally posted by Attention Horse:

Also guys, is anyone subscribed to this addon:

https://steamcommunity.com/sharedfiles/filedetails/?id=2636289143

Disabled comments on both addons page and on his profile is kinda worrying, and it was updated 2 days ago.

Well, I have just decompressed that addon and everything seems fine. I haven't seen anything ofuscated or suspicious.

Ok, thanks for the help!

[ZeroSorrow™]

though i dont believe the cryptomining myth everything else seems quite accurate
good job on this post

[Fearagen]

Originally posted by His Wife:

though i dont believe the cryptomining myth everything else seems quite accurate
good job on this post

It is not a myth, higher than normal GPU usage while playing with the affected mod that plays an ad in the background through the game's audio. Even Anti-Viruses like windows defender or other popular anti-viruses detected it as such.

[ZeroSorrow™]

thats something
i did not think addons could even do that