It's been demonstrated in the past that server can detect the pipe to shell and modify content - timing attack, if I recall correctly

Or serve a different script based on browser headers.

Out just develop a really useful node script that then gets a little extra.

Which is why it could only be done in a vm. VM breakout is still a risk but at the end of the day it's only ever about mitigation not panacea. A startling number of people use this method too what with the plethora of package managers available. The evildoer's best friend laziness - just keeping going longer than someone on average would reasonably expect you to, i.e. not very.