Wallpaper Engine To Remove Application-Type Wallpapers After Malware Reports
The removal of a legacy feature used by less than half a percent of wallpapers shows how a single security report can force a developer to shutter a core design philosophy from the software's early access era.
Key Facts
- The Wallpaper Engine Team announced on June 30 that it will delete all application-type wallpapers from the Steam Workshop within about a week, following reports of malware in the format.
- Cybersecurity firm Kaspersky reported on June 16 that dozens of application-type wallpapers on the Steam Workshop contained malware, with each downloaded thousands or tens of thousands of times.
- Application-type wallpapers account for only 0.5% of all wallpapers on the platform, and the number of affected users is very small.
- The team explained that the application type was a legacy feature from the software's early development, inspired by Android sideloading, and was hidden by default with a warning screen.
- Users who wish to keep their application-type wallpapers can back them up locally before the deletion.
Reporting from 3 sources: Automaton, GameBusiness.jp, Game Spark.
The Wallpaper Engine Team announced on June 30 that it will delete all application-type wallpapers from the Steam Workshop within about a week, following reports of malware in the format. The decision comes after cybersecurity firm Kaspersky reported on June 16 that dozens of application-type wallpapers on the Steam Workshop contained malware, with each downloaded thousands or tens of thousands of times. Application-type wallpapers, which allow creators to run executable (.exe) files as wallpapers, account for only 0.5% of all wallpapers on the platform, and the number of affected users is very small. The team explained that the application type was a legacy feature from the software's early development, inspired by Android sideloading, and was hidden by default with a warning screen. Development has since progressed with built-in editors and SceneScript, a JavaScript-based language that can handle events like time and mouse clicks, making custom executables unnecessary. The team stated that the risks of maintaining the application type now outweigh its benefits. Users who wish to keep their application-type wallpapers can back them up locally before the deletion. The removal applies only to the Steam Workshop; users can still create application-type wallpapers on their own.
The Wallpaper Engine Team announced the removal on June 30, with the deletion scheduled to begin during the week of July 5. As part of the transition, most application-type wallpapers will first be set to "friends-only" visibility before being permanently removed from the Steam Workshop.
The team explained that the Steam Workshop lacks a feature to lock item updates, meaning a creator whose account is hijacked could push a malicious update to a previously safe wallpaper. The developer added that such account hijacking for malicious updates has not actually occurred, but it is a theoretical risk that factored into the decision.
"We want everyone to feel completely safe using Wallpaper Engine," the team stated in the announcement. The software entered early access on Steam in 2016 and officially released in 2018. It has approximately 2.8 million registered wallpapers on the Workshop at the time of writing, with peak concurrent users reaching around 130,000 according to SteamDB.
The team described the original application-type feature as a "naive assumption" in retrospect. The format was inspired by Android sideloading, designed to give knowledgeable users maximum freedom with a non-skippable warning screen and default hiding from searches. Since the current tool can create most expressions using its built-in editors and SceneScript, the team concluded that the application type is no longer necessary.
Synthesized by Yomimono from the 3 cited sources below, including Japanese-language reporting where cited, then editorially reviewed before publishing.