At least the malware does already run on the coders machine. Fun starts, when malware just start to run on users machine and the coders are not coders anymore, just prompters and have no idea how such a thing can happen.

Isn't that already the case? Coders already think composer and node are great, an ecosystem predicated upon running thousands of untrusted pieces of code without any review or oversight.

The trust framework is all out of wack.