Do third party drupal modules pose a security risk? This may very well be a stupid question but there is no avoiding it now. Unfortunately myself and many others succumbed to the temptation of skipping learning ubercart in lieu of obtaining a seemingly quick and easy 3rd party module for commerce. 

Today drupal alerted me to an update for this 3rd party module but deleting it is not picked up by the refreshed module list, it simply vanishes and then when you try installing new version it remains stuck in checked position so that no new version can be installed and no uninstall can ever take place.

Of course the creator of this module has disappeared off the planet leaving myself and many others with less money in our pockets and red faced and some very angry with no support.

All of us say it is the first paid drupal module we've ever acquired because it did seem such a very good idea and easy to implement and the young man who made it was extremely helpful and professional at first.

It is still working on my site albeit unable to be updated but strange companies like soso.com in China have infiltrated this creator's site and are being listed in user's list of domains including mine so is this not a most terrible security risk for anyone using it with rest of the well maintained open source drupal?

update: the owner of these modules has actually returned and is back to usual professional good self. :) all's well that ends well.
Well, have you deleted that module without disabling &amp; uninstalling it first? Some of your effects seems to be that way. Anyway, automatically updating a module from 3rd-party server is only as secure as his server. If you did it, and source server was compromised, you should consider yours compromised, too. Only safe way? Revert from backups to the last snapshot you are reasonably sure to be safe, and then do not update that module (possibly uninstalling it as soon as feasible).