2005. I'm playing this music CD in my computer. Sony: hang on, I'm install a rootkit on your computer without your knowledge.
The project manager responsible who used to work in the advertising industry tries to damage-control things and locks/hides the ticket. Another mozilla staffer unlocks/unhides it and states it was improperly hidden/locked.
The ticket is then made uber-double-super-secret so that not even mozilla staff can view it: https://bugzilla.mozilla.org/show_bug.cgi?id=1423003
Other tickets about it are locked because of "off topic comments."
Coverage: https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...
Then there was the Cliqz incident:
https://www.reddit.com/r/firefox/comments/74yo19/cliqz_and_m...
They actively worked to hide the plugin's true nature: https://bugzilla.mozilla.org/show_bug.cgi?id=1392855#c5
Cliqz was a division of Burda Media.
(FWIW, in the 90's there were a few instances where commercially produced software managed to go out carrying viruses. :( )