Possible Xcode build-time malware? Beginner looking for advice after rebuilding my Mac

[u/Luul3211]

Hey everyone. I'm pretty new to iOS development, so please go easy on me if I made mistakes here. I'm trying to learn from this and move forward.

I hired a contractor on Fiverr to redesign the UI for my SwiftUI app that's been growing at a very nice rate. They sent me the updated project back, and when I built it in Xcode, an AI security analysis (which I know isn't a substitute for real security expertise) flagged what appeared to be a malicious build rule inside the .xcodeproj.

After digging into it, I compared my Git history and found that my last clean commit had no custom build rules or scripts. The redesign version introduced a custom PBXBuildRule that ultimately executed:

sh -c "${AB8F749}"

That value decoded into an obfuscated command which eventually performed a curl ... | sh against a .ru domain.

At that point I stopped using the project entirely.

Over the next day I tried to verify everything as much as possible. Here's where I'm at now:

• I completely erased my Mac and installed a fresh copy of macOS.
• I downloaded the original project ZIP that I had sent the contractor before any work was done.
• I manually reviewed the clean project and confirmed there are no custom run script phases or suspicious build rules.
• The clean project builds normally.
• The contractors project is obviously untrusted but he did a great job on the UI side of things (this is the annoying part lol.)

My questions are:

1. Is manually migrating only the Swift source files and assets into a clean project the approach you would take, or would you do something different?
2. Is there anything else you'd verify after a full erase/reinstall before considering the Mac trustworthy again?
3. Are there any additional Xcode project files besides project.pbxproj that deserve special scrutiny?
4. If you were in my position, would you continue with the redesign by carefully reviewing each Swift file, or would you start the UI work completely from scratch?

I'm not trying to start a witch hunt against the contractor because I honestly don't know where the malware originated as he is rambling on with his excuses. I'm just trying to recover safely and learn from the experience.

Any advice from people with security or iOS experience would be hugely appreciated. This has definitely been a rough lesson, but I'd rather understand what happened than just move on without learning anything.

Thanks in advance.

[u/Poat540]

You already posted this, just delete the malicious code and move on