"A root compromise and a Trojan horse were discovered on gnuftp.gnu.org, the FTP server of the GNU project. The machine appears to have been cracked in March 2003, but we only discovered the crack in the last week of July 2003. The modus operandi of the cracker shows that (s)he was interested primarily in using gnuftp to collect passwords and as a launching point to attack other machines. It appears that the machine was cracked using a ptrace exploit by a local user immediately after the exploit was posted. (For the ptrace bug, a root-shell exploit was available on 17 March 2003, and a working fix was not available on linux-kernel until the following week. Evidence found on the machine indicates that gnuftp was cracked during that week.)" says the Free Software Foundation.
The FSF is still checking the source code of software that could also have been compromised to make sure many thousands of free software (aka "open source") advocates have not been downloading programs with an added Trojan or back door for the past four or five months.
There's an amusing discussion on Slashdot.
