There was the famous attempt to insert a backdoor in the Linux sourcetree[1]. That wasn't quite the same as it wasn't a pull request (or equivalent), was instead done by directly modifying the CVS mirror of the BitKeeper sourcetree.

[1] http://lkml.indiana.edu/hypermail/linux/kernel/0311.0/0621.h...

It happened to UnrealIRC a few years back. The tarball on their website was adulterated to include a backdoor and the published checksums were altered too. They've since moved to cryptographic signatures for verification.

http://www.irc-junkie.org/2010-06-12/some-unrealircd-3-2-8-1...

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt