Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now
@eighthave @davidgerard Honestly: I think if he had bad intentions he probably would have just complied. To me this person sounded like an eager developer with to much ego and to little knowledge. But it was really interesting to read how close this MR was to being merged and how much damage it could have done, intentional or unintentional.