It should be noted that the malware bundling was done when SourceForge was owned by DHI Group, Inc. And now, for many years already, SourceForge has switched owners (BIZX/Slashdot). They have undone the bundling and are now trying to manage it like it was managed before. It seems like it's going well.

I would consider SF a viable Github alternative, but the bad reputation caused by a temporary owner just seems to stick forever.