A great example of this would be the XZ backdoor, which never got commited to the source tree, but got implanted in the release tarballs, which were built on th

A great example of this would be the XZ backdoor, which never got commited to the source tree, but got implanted in the release tarballs, which were built on the attacker's systems