Being open source does not ensure software is bug free but its highly highly likely to not be malicious. Usually malware authors don't actually write software, they tack it on to other peoples software or write stuff that doesn't do anything useful at all. Not once have I ever heard of malware making its way in to the debian repos.

The worst I have seen is xscreensaver embedding a message in the code to complain about the old version a year after release.