Compromised Flutter package on pub.dev contains XCSSET malware

Aikido found XCSSET malware in universal_file_viewer 0.1.5 on pub.dev: an infected maintainer machine injected worm build hooks into example files, the first compromised package found on pub.dev.