It's a beta release only available for insider subscribers.
They also mention this issue in a channel9 video and are very well aware of the issue.
It's a ubuntu based subsystem. Apt-get probably uses their official repo and you would have to get your malware into that first and then make some windows beta-user install your new and unknown package.