Binary infected with malicious payload is more likely to be detected by antivirus or by manual checking of the signature/checksum if user cares to.
Infected build system? In case of linux distributions, there are maintainers and packagers responsible for their source and binaries. In case of javascript, does anyone care?
