Valve’s unpatched JavaScript engine and incomplete modification vetting process for Steam-delivered mods led to user systems being backdoored.