Speaking of backdoors in popular open source libraries, the recent incident with xz is exemplary I think.