Once the malicious package is added to the universe of acceptable packages, it doesn't matter much. Prompt engineering is not a solution you that.
Yes, that wasn't a priority here, but I also don't think it's much of a concern with e.g. GPT-4's `system` vs `assistant` vs `user` roles. Would be another thing to work on, but nothing worth doom and gloom.
Although, 'script(/injection) kiddie' will be an interesting phenomenon in the future...
I see a fresh new generation of supply chain attack, or more prompt engineering to hopefully filter out malicious packages