Happens alot.  Did you know that daniele and fiatjaf snuck spyware into njump dot me (the link in the title), too?

Check it yourself.

When it comes to "open" source, dont trust, verify.