Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour.

A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.