Everything for which you haven't read, fully understood, and compiled from the source can be compromised. Just because there's source for something somewhere doesn't mean the binary you downloaded is secure.
> Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus.
https://m.youtube.com/watch?v=eunYrrcxXfw
And then we get into hardware design...
[0]: http://www.quora.com/What-is-a-coders-worst-nightmare/answer...