> the MO for said agencies to compromise OSS projects is to play the long game of making numerous benign commits Are there examples of this actually happening—

> the MO for said agencies to compromise OSS projects is to play the long game of making numerous benign commits Are there examples of this actually happening— that is, a nominally trusted committer intentionally adding a backdoor to a widely used OSS project? If this is in fact "the MO for said agencies", then there should be several examples you can point to.