There is a pretty strong ops/dev divide where I work. There are some repos I have admin access to, those I could push malicious code directly, execute a build

There is a pretty strong ops/dev divide where I work. There are some repos I have admin access to, those I could push malicious code directly, execute a build and authorize a push to production. Most products I work on have a fairly long build time and that'd be a fairly noisy process (emails sent off). It'd work if you are just trying to get a shell, but it'd assuredly alert someone that something bad is happening.