It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.

It is possible but visible, and it means burning an identity, so it's not irrelevant