"malware"/"spyware" is complicated. Does Ubuntu count as spyware? They have some integration with Amazon web shops. Does Debian? It has a "popularity contest" for packages ( http://popcon.debian.org/ ).
Can you come up with a definition of "malware" that excludes actual malware and excludes the Debian popularity contest?
Malware, for a given user and computer, is installed software that, in the absence of constraints (such as imperfect information, limited time and ability), would not be installed.
This defines malware as a space rather than a binary, but I'm fine with that.
IE. If you license your code, project A, with 'GPLv3 + no-stupid-software', and project B wants to use your code but they're licensed as 'GPLv3', legally they can't because the licenses are incompatible. Project B would have to amend their license to add the 'no-stupid-software' clause to make it compatible with project A (But of course doing that may introduce other license incompatibilities with other pieces of software, and projects with a decent number of contributors probably don't have much of an option to change license at this point).
I don't know if there would be any incompatibilities going the other direction: You want to use project B in your software, and project B has the license 'GPLv3' but your software has the license 'GPLv3 + no-stupid-software'. I think that should be ok, assuming that clause doesn't conflict with anything already in the GPL, but again, IANAL.
Trademarks are expensive and take effort, though, so this is not a model for small maintainers.