apt-get gets base-passwd from fr? could be a security problem?

[JOAQUIN CARABALLO MORENO <a2204@dis.ulpgc.es>]

Hello!

In my last apt-get update ; apt-get upgrade from
http://ftp.fr.debian.org packages base-config and net-something were
downloaded and upgraded.  It sounds a bit strange to me because I
thought such a package (base-config, at least) should be provided by 
http://security.debian.org/ instead.  Besides, five minutes after my
system was hanged.

Is there any security problem with the french mirror?... or maybe I'm 
just too much a paranoid? :) 

Thanks for reading.

I'm not subscribed to the list, so please add a "CC:" to my address to
the answer, if you don't mind.  (I'll try to read it next days from the 
web interface anyway.)

            Joaquin

P.D.: I'll show you here the related sources.list line, just in case you
find it interesting:
------------------------------------------------------------------------
deb http://ftp.fr.debian.org/debian testing main contrib non-free
------------------------------------------------------------------------