[Some notes][1] about an attempt to get a backdoor into the Linux kernel, circa 2003. Apparently unsuccessful.  The [contemporary commentary][2] was fairly interesting.

The linux kernel distribution machines got [compromised again in 2011][3], but it seems like no code got changed that time.

UPDATE:
Looks like a sourceforge mirror had [a version of phpMyAdmin with a built-in backdoor][4].

  [1]: http://lkml.indiana.edu/hypermail/linux/kernel/0311.0/0621.html
  [2]: http://www.securityfocus.com/news/7388
  [3]: http://lwn.net/Articles/457142/
  [4]: http://arstechnica.com/security/2012/09/questions-abound-as-malicious-phpmyadmin-backdoor-found-on-sourceforge-site/