Compromised Flutter package on pub.dev contains XCSSET malware

Aikido discovered a variant of the XCSSET macOS worm embedded in the example directory of the pub.dev package `universal_file_viewer` (v0.1.5). The package included injected build hooks that silently contact C2 domains (e.g., `5yotmxcc54l9xda.ru`, `qdgs232i-q.ru`, `ejntin6hkjt7gj2.ru`) and trigger a multi-stage infection chain which downloads an in-memory loader, deploys propagation modules (android_finder, git_finder, replicator_finder), establishes persistence via a fake Launchpad bundle, and fetches theft modules that exfiltrate browser credentials, Telegram sessions, Notes, clipboard data, and targeted folders; indicators and artifact patterns (obfuscated xxd usage, base64-nested pre-commit hooks, PBXBuildRule entries) are provided along with mitigation/detection recommendations.