Old, it's not new that macro expansions, build files and build tooling can do that. (And if we sandboxed that, you still get infected release builds, check your deps..)

See NPM installations and "please sponsor this project" messages, which can also give you a virus.