We got very close in XZ Utils.

https://en.wikipedia.org/wiki/XZ_Utils_backdoor