I'm honestly a bit surprised that there haven't been more viruses like this that try to infect users from 'upstream'. If you really think about it, there's lots of programs that could be infected and inject malware into some code before it's shipped...compilers, build systems, obfuscators, installers, etc.