> If GitHub/Bitbucket start bundling malware into binaries one day will we tarnish all of the developers/companies open sourcing there too?

Yes. And hopefully that would be an impetus to move were that to happen. Any repo at one location that was at SF the day prior, and I knew they moves, immediately looks better in my eyes, because they are no longer helping support that system.