I just clicked on their cookie prompt and saw my browser being redirected to PayPal for some reason. Shut down the tab immediately and don't intend to check out the project at all.
Err, I have no idea what you saw, but it definitely wasn't your browser being redirected to PayPal - unless you somehow accidentally clicked on the "Donate" button.
Fortunately it's a .tar.gz rather than an executable, so the amount of harm SourceForge can do is limited.
We're going to need a SHA-1 or something - they could just rezip the compromised binary.
Sourceforge's new owners claim[0] they stopped doing that stuff. I haven't checked to see if it's true but I know it's been discussed on HN before.