I just had a thought about dependency chain attacks - has there been any example where instead of overtly compromising the code, they injected an exploitable bug?

Though I guess it'd be hard to prove intent in this case.