You can easily search for news on Linux malware. Most recently npm was affected.

Npm is used by a lot of software, so updating your software from valid sources could easily infect your machine.

It’s also dead simple to misconfigure something on Linux, like your firewall, leaving your machine exposed to the internet. Linux doesn’t bother you nearly as much as windows does when it comes to updating and restarting. Windows used to be that way too but had to adapt to the changing threat landscape.

With VMs you can try as many at once as your system can support, with less risk than booting up on a livecd, and the ability to switch between them without having to reboot.

Moving files manually is fine.