Is Malicious code committed to git repo, rather than only compiled binary?

I suspect that attacker thought that Xcode project contains some binary/text blobs so hard to notice it.