What changed
Aikido Security reported on September 8 that version 0.1.5 of the legitimate Flutter package `universal_file_viewer` contained a variant of XCSSET, a macOS worm. Aikido says the maintainer's machine had been infected and malicious project/build files were then included when the package was published to pub.dev; it traced the package back to a compromised GitHub repository. Pub.dev now shows versions 0.1.5 and 0.1.6 as retracted, with 0.1.7 available as the current version. Follow-up research from Ossprey reported another legitimate Flutter package, `surveyjs_flutter`, affected through similar XCSSET contamination, broadening the event beyond one accidental package release.
Why it matters
Many software-supply-chain defenses focus on stolen publisher tokens or malicious maintainers. This incident demonstrates a different route: compromise the trusted developer's workstation, let malware modify repository/build files, and wait for the maintainer to publish normally. Registry authentication can be perfectly valid while the artifact is still malicious. For Flutter teams—especially developers building on macOS—the response therefore includes workstation and repository integrity, not only dependency pinning and publisher-account security.
The publisher appears to have been an unwitting carrier
Aikido says `universal_file_viewer` was not intentionally weaponized by its maintainer. XCSSET on the developer machine injected malicious build/project content, which then traveled into the GitHub repository and the pub.dev package when a new version was published.
XCSSET spreads through development projects
The malware targets developer environments and can insert malicious hooks into Android Gradle projects, Xcode projects and Git repositories. That makes a compromised developer machine unusually dangerous because each normal commit or package release can become another distribution path.
The malicious package versions are now retracted
Pub.dev's current version history marks `universal_file_viewer` 0.1.5 and 0.1.6 as retracted and lists a newer 0.1.7 release. Consumers should still inspect lockfiles and caches rather than assuming retraction automatically removes already downloaded artifacts.
Follow-up research suggests the pattern was not unique to one package
Ossprey says it identified `surveyjs_flutter` as another legitimate package affected by XCSSET contamination. That makes the event more instructive than a single low-download package and suggests teams should search projects and registries for the infection pattern rather than only one package name.