"Godot hijacked" initially made me worry that they'd had their servers taken over in a supply-chain malware attack, but it seems to just be that some malware is being written in GDScript because it's cross-platform and not yet picked up by antivirus software.

By the same token as "Looking at the number of popular games developed with Godot, that would put the attack surface at approximately 1.2 million people", you could say the fact some malware is written in C++ makes anyone who has ever used software written in C++ (~8 billion people) part of the attack surface.

This is a confused and frankly worthless article. It is malware made in Godot. It is not targeting users of Godot, it is not distributed through Godot-related channels, nothing got "hijacked" (except perhaps the infected systems).

The researchers talk about the possibility that data packs for real games could be infected in the future, but this malware just includes its own copy of the game engine.

Post by the researchers: https://research.checkpoint.com/2024/gaming-engines-an-undet...

Statement by Godot: https://godotengine.org/article/statement-on-godloader-malwa...