Have you ever heard of malicious code in the Debian repos?

I think I heard so a few times, yes. Depends on what you define as “malicious” and which of the repos you’d call Debian repos. Is Debian only stable or is it unstable and testing or contrib or non-free aswell?