As the title says, be careful where you download Apple Patches or, this case, XCode. There is a interesting article about a modified XCode floating around in china: XCodeGhost

Our downloads here should be free of “injections” from 3rd party. But you’ll never know, so please check the signature of your downloads every time you download it from somewhere else then Apple.