It happened to UnrealIRC a few years back. The tarball on their website was adulterated to include a backdoor and the published checksums were altered too. They've since moved to cryptographic signatures for verification.

http://www.irc-junkie.org/2010-06-12/some-unrealircd-3-2-8-1...

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt