pub.dev: universal_file_viewer 0.1.5 Flutter package contains XCSSET macOS malware
Severity: medium · Patch status: no-fix-needed · Since 2026-09-08
Aikido detected XCSSET malware inside universalfileviewer 0.1.5, a Flutter file-preview package on pub.dev (~500 downloads) — the first compromised package found on that registry. The maintainer's macOS machine was infected with the XCSSET worm, which injected malicious hooks into example/ Android Gradle and iOS/macOS Xcode build files before publication. The Dart library itself is clean and simply adding the package as a dependency does not trigger infection; risk applies to anyone cloning the repo and building the example app, which would contact attacker C2 servers and deploy a multi-stage macOS stealer/orchestrator. The worm also infects other Gradle projects, Xcode projects and git repos on compromised machines, and GitHub search shows maintainers still pushing infected projects. No vendor fix; users should avoid building the example and audit machines.
What to do
- Do not clone or build the example app of universal_file_viewer 0.1.5; if you have, isolate and rebuild affected macOS machines
- Audit macOS developer machines for XCSSET indicators: unexpected preBuild hooks in Gradle files, PBXBuildRule entries in Xcode projects, and malicious pre-commit hooks in git repositories
- Check other local Android/Xcode projects and git repos for injected hooks, as the worm propagates to every project on an infected machine
- Verify pub.dev dependencies' source for suspicious build-file injections before building from source
- Block known C2 domains (5yotmxcc54l9xda[.]ru/a, qdgs232i-q[.]ru, ejntin6hkjt7gj2[.]ru) at network egress
Sources
All live incidents on Threat Watch
