[nzp]

Some years ago FreeBSD had an intrusion via one of the commiter's machine or stolen SSH key, I don't remember which any more, but I do remember that it took months for the package building infrastructure to get fully operational again. I think they never got to the bottom of that (who did it or why). Linux had a very similar incident if I'm not mistaken.

It's such a standard and effective method in human intelligence, that it's extremely naive to think an analogue wouldn't be used extensively in signals intelligence too.