Ditto for Linux and Android. I'm sure I could find a sketchy closed source kernel module somewhere out there that's actually malware. That's not a problem in practice though because I'd have to leave the confines of the official repositories for my OS and intentionally seek it out.

(I suppose NPM could be an interesting point of discussion here though.)