Downfall, a fan expansion for the popular Slay the Spire indie strategy game, was breached on Christmas Day to push Epsilon information stealer malware using the Steam update system.

The publisher got pwnd and the malware got pushed out over Steam. No different from someone publishing a malicious game directly.