People often ask me if I ever have detected an attempt to plant a backdoor in #curl. But I have never. I use to say that exploiting a mistake, a security vulnerability, is a MUCH more likely attack scenario because trying to merge a backdoor is super difficult.

But that only goes for outsiders. An insider, a trusted maintainer since years back, of course has a much better opportunity to sneak in malicious code etc. Still not easy though.