Though Debian's "popularity contest" is opt-in.
Can you come up with a definition of "malware" that excludes actual malware and excludes the Debian popularity contest?
Malware, for a given user and computer, is installed software that, in the absence of constraints (such as imperfect information, limited time and ability), would not be installed.
This defines malware as a space rather than a binary, but I'm fine with that.