Microsoft Threat Intelligence advised users to inspect and verify any Xcode projects downloaded or cloned from repositories and to install applications only from trusted sources to avoid XCSSET infection.

Quotes that support claims

“(..) users must exercise extreme caution toward unapproved downloads of Xcode projects and apps. Users need to ensure software authenticity before they install new applications since the proper security stands in the Mac App Store.”

“Users must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects. They should also only install apps from trusted sources, such as a software platform’s official app store.”