They did wrap installers in malware but have stopped now. Regardless, the site is very poorly designed and makes for a bad developer and user experience. To users and potential contributors, using SourceForge is synonymous with not caring.
I've registered a custom domain, which will be our primary user-facing point of contact. Developers use SF essentially purely as a Mercurial host; everything else is run over eMail.