Yes, and way before vibe-coding is a thing. Back in 2022, a version of node-ipc formatted the disk of users in Russia and Belarus.

https://arstechnica.com/information-technology/2022/03/sabot...