&gt; the MO for said agencies to compromise OSS projects is to play the long game of making numerous benign commits<p>Are there examples of this actually happening— that is, a nominally trusted committer intentionally adding a backdoor to a widely used OSS project? If this is in fact &quot;the MO for said agencies&quot;, then there should be several examples you can point to.