Plugins are great and add great functionalities to your blog, but these programs have access to your blog’s files and database. So you’re giving someone’s program free access to all this. (same with themes, like you said)

This is a great reminder to everyone that you can’t really trust everything on the web.

Great reminder for everyone to not just automatically download something without doing a little research first.

There have been a couple of cases, like you mentioned. Generally it’s not the theme designer, sometimes it’s just that hackers tend to sneak in and they alter the themes. So, one should only download the theme from the actual developers website or from wordpress themes directory.

I would have to say the “safest” place to get themes would be the official WordPress Themes Directory. There they have a few automated checks for malicious code, plus a manual approval by a human moderator.

You can also get clean themes from other trusted sites. Just to name a few off the top of my head: Justin Tadlock, Brian Gardner, ThemeShaper, WPDesigner.

If the theme isn’t from a trusted source get it from the orig author. I have found that most themes with malicious intentions were downloaded from another source.

Of course if you code you are most likely going to catch some funny looking snippets but if you don’t code and easy(but not necessarily absolute)way to inspect your site is to use an analytics tool (as simple as igoogle) and check your external links. If it’s a new site and it’s high or even if it’s just higher than you suspect, dig deeper. I’ve found sites with hidden links by right clicking a live site and viewing the page source. Scan the file and double check the header and footer.

Sorry to have rambled but I have seen this a FEW times. The safest things is to go to WP, the orig Author, a trusted source and, well, learn to code. Even if just to be familiar with what your looking at.

Thanks.