Yes. Test is a perfect place to hide an attack - reviewers pay far less attention to test code than the (what they perceive to be) production code.