The audacity team has a blog post regarding the incident: http://www.audacityteam.org/compromised-download-partner/