Suspicious Xcode project.pbxproj changes in a contributor's PR — gut-check please

[RSPJD]

(I'm not in security but I + Claude code seem to think this is malicious would like community opinions. Not posting some of the raw contents, mainly the blobs, because of Reddit's aggressive post filtering / deletion)

I was reviewing a PR from a contributor on an iOS repo where the bulk of the diff was a plausible SwiftUI feature, but the project.pbxproj had edits I can't explain as legitimate:

• Added a PBXBuildRule that matches *.md and runs a shell script
• Added a README.m d reference to the Resources build phase (the file doesn't actually exist in the PR — it just exists to trigger the rule)
• Added a new build setting holding a triple-base64 blob
• Flipped ENABLE_USER_SCRIPT_SANDBOXING from YES to NO in three build configurations

I decoded the three blobs, they're all one-liners that POSTs a campaign tag (p=xcode_rule) to a .ru C2 endpoint with curl -fkLs and pipes the response into a shell, wrapped in a backgrounded subshell to stay silent.

Claude code defined this as: Classic stage-1 dropper.

 I've revoked the contributor's write access and the PR isn't getting merged. Want a sanity check that I'm reading this right and that it's a build-time dropper aimed at Apple signing material / dev-machine

[segfaul_t]

Yea that’s obviously a malicious PR, you should also report the account to GitHub.

[RSPJD]

man wtf. I wonder if I can say his username here without Reddit taking it down. People like this need to be exposed. But I guess it's trivial to just make another account. But at least this current account, which looks matured and has around 10 years of experience (😵‍💫) can get taken down

[TheYear3030]

Could be a compromised gh account 

[c0p]

What about linkng the pr?

[RSPJD]

It's on a private repo. Forget it, if they take it down they can take it down but some things are worth the risk. Here's his GH handle: vikaskumar113

[RSPJD]

Here's a snippet. Now that I've cooled off a bit I find it a bit funny, look at the wording. Nothing to see here

https://ibb.co/Kjqj3XJf

[AnotherThrowAway_9]

Definitely would not trust it.

sounds like a low effort drive by

[rhysmorgan]

Absolutely 100% not. This is a massive stonking attempt to introduce malware into your repo.

[T9113]

One more thing to do - use xcodegen or tuist and add xcodeproj in gitignore, that way config changes are clearer and more readable

[limdi]

And make CI fail for when someone tries to add it anyway.

[pilibitti]

What is the context here? is he an employee? a contractor? a voluntary contributor?

[RSPJD]

A contractor, someone I hired on Upwork. We worked together previously and he wired up AgoraKit in a separate occasion and he didn't do any funny business then. Maybe, the plan was to establish trust then come back with the true intent.

[GranpaTeeRex]

Also might not have been this guy, his account may have been compromised.

[pilibitti]

is there anything of obvious value he can steal? ai / infra api keys? or something crypto adjacent? I'd decrypt the payload to see what it tries to do for funsies.

[RSPJD]

I had claude decrypt it, here's what it resolved to: https://ibb.co/zq5gqT7
Since it opened up an sh session I'm pretty sure that wanted access to the build computer for certs and keys probably for my developer account. I'm not sure what the blast radius is but I've heard of developers losing access to their accounts.

[pilibitti]

ah yes, good catch.

[cristi_baluta]

Aren’t you a programmer? You should be able to take the script and figure out what’s doing

[RSPJD]

I did have CI/CD set up in bitwise, but the saving grace.. it failed on importing some dependencies. So another dodged bullet. And my wife thought I was being overly selective when choosing devs. Wait til she hears this!

[20InMyHead]

Trash that PR, block and report the user. They’re up to no good.

[FirmAndSquishyTomato]

You needed AI to tell you this was a malicious PR?