The issue

When playing single player or hosting a server from the menu a malicious mod can set a global setting that controls the location of the Lua script used to display the main menu. The script is then loaded as soon as the game session is exited.