If anybody remember's Thompson's "Reflections on Trusting Trust", this is a good example. The only thing compromised was the build system; this was completely invisible in the source.

https://www.zdnet.com/article/backdoor-found-in-webmin-a-popular-web-based-utility-for-managing-unix-servers/