It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.
It is possible but visible, and it means burning an identity, so it's not irrelevant
It is possible but visible, and it means burning an identity, so it's not irrelevant