Some notes about an attempt to get a backdoor into the Linux kernel, circa 2003. Apparently unsuccessful. The contemporary commentary was fairly interesting.
The linux kernel distribution machines got compromised again in 2011, but it seems like no code got changed that time.
UPDATE: Looks like a sourceforge mirror had a version of phpMyAdmin with a built-in backdoor.