There have been cases of crypto miners embedded but once discovered they’re nuked so quick it’s hard to get more than rumours.

C# modding is the most likely vector (rimworld, cities skylines, unity stuff) but Skyrim skse mods are raw code too. All can be misused.

Usually lua mods have a sandbox so they’re safe. Eg.factorio. and, um, more but my mind has gone blank.