---
id: 7542
title: "Compromised Flutter package on pub.dev contains XCSSET malware"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware"
published_at: "2026-09-08T00:00:00Z"
tags: ["supply-chain", "malware", "macos", "flutter", "dart", "xcsset"]
phying_url: "https://phying.com/item/7542"
lang: en
---

# Compromised Flutter package on pub.dev contains XCSSET malware

## Summary

Aikido found XCSSET malware in universal_file_viewer 0.1.5 on pub.dev: an infected maintainer machine injected worm build hooks into example files, the first compromised package found on pub.dev.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-09-08T00:00:00Z
- **Original:** https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware
- **Phying News:** https://phying.com/item/7542