In 2015 apple remove hundreds of apps from Appstore. Hackers some how managed to directly infect the build system of hacked XCode and upload infected apps to Appstore. Infected XCode where also available for download over the website and many unsuspecting developer were using them.
“We’ve removed the apps from the App Store that we know have been created with this counterfeit software,” Apple spokeswoman Christine Monaghan said in an email. “We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps.”
Apple has since then moved to .xip files which are basically xar archive which can be digitally signed.You can easily extract it using Archive utility and copy it to application or you can use xar -xf <YOUR XCODE 8&ABOVE>.xip to bypass archive utility. you can find a complete list of xcode 4/5/6/7/8 download versions here