Poisoned Pipeline / Incidents / AS116
pub.dev universal_file_viewer ships XCSSET (infected maintainer)
pub.dev / DartmacOS softwareDeveloper workstation
Aikido (8 Sep 2026): first malware they found on pub.dev. Flutter package
universal_file_viewer 0.1.5 was published from a maintainer machine
already infected with XCSSET. Dart lib/ is clean; example/ Android Gradle
and Xcode projects carry wormed build hooks. Adding the package as a
dependency does not fire it — cloning and building the example app does.
XCSSET then worms into every Gradle/Xcode/git repo on the machine and
steals browser/Telegram data. Unit 42 / Microsoft cover the malware
family; Aikido covers this registry hit.
Mapped techniques
- T0153 Compromised developer workstation
- T0121 Compromised legitimate artifact
- T0111 Malicious code contribution to an open-source repository
- T0169 Push implants across repositories
supply-chain infected-maintainer publish
Maintainer Mac already had XCSSET; publish shipped the hooks.
universal_file_viewer 0.1.5 on pub.dev.
Wormed example/ Gradle and pbxproj files.
android_finder / git_finder / replicator_finder on the next victim.