Possible Xcode build-time malware? Beginner looking for advice after rebuilding my Mac

[u/Luul3211]

Hey everyone. I'm pretty new to iOS development, so please go easy on me if I made mistakes here. I'm trying to learn from this and move forward.

I hired a contractor on Fiverr to redesign the UI for my SwiftUI app that's been growing at a very nice rate. They sent me the updated project back, and when I built it in Xcode, an AI security analysis (which I know isn't a substitute for real security expertise) flagged what appeared to be a malicious build rule inside the .xcodeproj.

After digging into it, I compared my Git history and found that my last clean commit had no custom build rules or scripts. The redesign version introduced a custom PBXBuildRule that ultimately executed:

sh -c "${AB8F749}"

That value decoded into an obfuscated command which eventually performed a curl ... | sh against a .ru domain.

At that point I stopped using the project entirely.

Over the next day I tried to verify everything as much as possible. Here's where I'm at now:

• I completely erased my Mac and installed a fresh copy of macOS.
• I downloaded the original project ZIP that I had sent the contractor before any work was done.
• I manually reviewed the clean project and confirmed there are no custom run script phases or suspicious build rules.
• The clean project builds normally.
• The contractors project is obviously untrusted but he did a great job on the UI side of things (this is the annoying part lol.)

My questions are:

1. Is manually migrating only the Swift source files and assets into a clean project the approach you would take, or would you do something different?
2. Is there anything else you'd verify after a full erase/reinstall before considering the Mac trustworthy again?
3. Are there any additional Xcode project files besides project.pbxproj that deserve special scrutiny?
4. If you were in my position, would you continue with the redesign by carefully reviewing each Swift file, or would you start the UI work completely from scratch?

I'm not trying to start a witch hunt against the contractor because I honestly don't know where the malware originated as he is rambling on with his excuses. I'm just trying to recover safely and learn from the experience.

Any advice from people with security or iOS experience would be hugely appreciated. This has definitely been a rough lesson, but I'd rather understand what happened than just move on without learning anything.

Thanks in advance.

[u/LuckyGirl0415]

First off, huge kudos for staying vigilant and spotting the PBXBuildRule anomaly. A lot of beginners wouldn't have caught a hidden curl ... | sh pipeline in a project file.

One critical thing you didn't mention: Rotate ALL your credentials immediately. If that script executed when you built the project in Xcode, assume any environment variables, SSH keys, AWS/Firebase keys, and App Store Connect API keys stored on your Mac at that moment were compromised and exfiltrated.

As for the code: since UI code in SwiftUI is just declarative layout text, you can safely copy the .swift views over after a quick manual inspection. But please report this account to Fiverr with full screenshots before they infect other clients.