As far as I am aware, PureScript is used by one Indian startup which provides a very popular payment gateway integration SDK and used by millions each day. Any remote code injection could be well used to inject code to infect their SDK as well.