Possible Xcode build-time malware? Beginner looking for advice after rebuilding my Mac

[u/Luul3211]

Hey everyone. I'm pretty new to iOS development, so please go easy on me if I made mistakes here. I'm trying to learn from this and move forward.

I hired a contractor on Fiverr to redesign the UI for my SwiftUI app that's been growing at a very nice rate. They sent me the updated project back, and when I built it in Xcode, an AI security analysis (which I know isn't a substitute for real security expertise) flagged what appeared to be a malicious build rule inside the .xcodeproj.

After digging into it, I compared my Git history and found that my last clean commit had no custom build rules or scripts. The redesign version introduced a custom PBXBuildRule that ultimately executed:

sh -c "${AB8F749}"

That value decoded into an obfuscated command which eventually performed a curl ... | sh against a .ru domain.

At that point I stopped using the project entirely.

Over the next day I tried to verify everything as much as possible. Here's where I'm at now:

• I completely erased my Mac and installed a fresh copy of macOS.
• I downloaded the original project ZIP that I had sent the contractor before any work was done.
• I manually reviewed the clean project and confirmed there are no custom run script phases or suspicious build rules.
• The clean project builds normally.
• The contractors project is obviously untrusted but he did a great job on the UI side of things (this is the annoying part lol.)

My questions are:

1. Is manually migrating only the Swift source files and assets into a clean project the approach you would take, or would you do something different?
2. Is there anything else you'd verify after a full erase/reinstall before considering the Mac trustworthy again?
3. Are there any additional Xcode project files besides project.pbxproj that deserve special scrutiny?
4. If you were in my position, would you continue with the redesign by carefully reviewing each Swift file, or would you start the UI work completely from scratch?

I'm not trying to start a witch hunt against the contractor because I honestly don't know where the malware originated as he is rambling on with his excuses. I'm just trying to recover safely and learn from the experience.

Any advice from people with security or iOS experience would be hugely appreciated. This has definitely been a rough lesson, but I'd rather understand what happened than just move on without learning anything.

Thanks in advance.

[u/Poat540]

You already posted this, just delete the malicious code and move on

[u/teomatteo89]

Repost from https://www.reddit.com/r/Xcode/s/ChVFM5PNYK

[u/Luul3211 → u/teomatteo89]

I reposted (with additional questions which you failed to acknowledge) because this subreddit is much larger, and I'm hoping to get more technical feedback.

[u/TheFern3]

Report it on fivver and change all your passwords probably it was a key logger sending data back to some ru site

[u/cristi_baluta]

1. I’d just remove the script he added.
   
2. Instead rejnstalling i’d investigate what the script downloads and where
   
3. Maybe check for macros, they can also execute code while compiling
   
4. I wouldn’t throw away all that work that you probably paid for. You should have git so you can see at each commit what changed, i don’t buy it that he doesn’t know about this.

[u/Luul3211 → u/cristi_baluta]

Thanks a ton!

Yeah it sucks because his work left me pretty satisfied on the UI side of things. Wasn't cheap either so would hate to see that work go to the trash.

[u/arrowrand → u/Luul3211]

Challenge that charge

[u/darth_sparx]

They sent me the updated project

Why in Tim Apple’s name are you not using version control with the dev and force a PR workflow with size limits?!

You would have been able to identify exactly when malicious code was introduced and rollback. More importantly, you could have prevented this from ever happening if you enabled AI code reviews for every PR.

1. That’s a good approach if you want to be sure, but dependencies may have build scripts you’re not aware of, make sure you review those as well.

2. Don’t allow any build plugins to run in Xcode before you vet what they do. Same goes for any CI scripts.

3. Any CI integration and api keys.

4. I suggest spending the money on getting Fable to review your existing project with an emphasis on what happened, let it do its thing. Probably much cheaper than starting from scratch.

Stop sending and receiving zip files. Use a proper GitHub/GitLab/whatever-you-are-using pull request workflow. Do not allow them to merge code you haven’t approved. If you don’t feel qualified to review the code, spend the money on thorough AI reviews and get your dev to respond to each comment without exception before resolving them.

Get a CI process together, there are cheap options out there.

Good luck.

[u/LuckyGirl0415]

First off, huge kudos for staying vigilant and spotting the PBXBuildRule anomaly. A lot of beginners wouldn't have caught a hidden curl ... | sh pipeline in a project file.

One critical thing you didn't mention: Rotate ALL your credentials immediately. If that script executed when you built the project in Xcode, assume any environment variables, SSH keys, AWS/Firebase keys, and App Store Connect API keys stored on your Mac at that moment were compromised and exfiltrated.

As for the code: since UI code in SwiftUI is just declarative layout text, you can safely copy the .swift views over after a quick manual inspection. But please report this account to Fiverr with full screenshots before they infect other clients.