"Reflections on Trusting Trust" was a demonstration of this in the C ecosystem long before package managers were a thing.