The list of packages embedding code from other projects is maintained in the secure-testing svn repository:

http://anonscm.debian.org/viewvc/secure-testing/data/embedded-code-copies?view=markup

Send suggestions or additions to

mailto:secure-testing-team@lists.alioth.debian.org