For sure! From malicious PRs being merged, OS level code injections, supply chain “attacks”, exploits being ignored for years, exploits that de-anonymize and even more.
Check out these issues, PRs and discussions on GitHub.
Issue #14410
Issue #5533
PR #14333
Discussion #13249
Discussion #1324...