Like the XScreenSaver time bomb that caused a nag screen to pop up on April 1 one or two years ago on peoples screens? Debian distributed this code for years without realizing because no one even glanced at the code. The developer didn't even try to hide the time bomb, he even provided angry comments why he added the code.

The only reason Debian didn't distribute some really bad malicious code (that we know of) yet is because they got lucky and no developer tried to mess with them.