I remember reading this news article about people trying to get oil out of Iran and they were doing it by dumping it into this concrete-lined hole and the explanation was that there’s a pipe running between the hole across the border to I guess another team who receives the oil… so it looks like you’re just dumping oil into the desert.

I don’t see how it would happen. Nix is immune bc hashes are constantly checked, you can’t swap in malicious code without a person noticing bc it might throw a mismatched hash error. Also nixpkgs has been really good about vetting packages, I don’t expect them to look too closely into the source codes of everything but if something malicious were to happen like what is happening to AUR someone would see it way faster