If I was doing an attack like this, I&#x27;d wait for an opportunity to slip it into a huge, mundane change.<p>For example, changing the repository from Mercurial to Git. Splitting or combining two repositories. Moving lots of files between directories. Running an autoformatter over the entire codebase. Something like that.<p>Every code review tool I&#x27;ve seen there&#x27;s &#x2F;some&#x2F; way you can get it to highlight thousands of trivial changes. And I don&#x27;t know about you, but I can&#x27;t promise I&#x27;d spot 1 evil change among 1000 trivial ones.