I just clicked on their cookie prompt and saw my browser being redirected to PayPal for some reason. Shut down the tab immediately and don't intend to check out the project at all.

Err, I have no idea what you saw, but it definitely wasn't your browser being redirected to PayPal - unless you somehow accidentally clicked on the "Donate" button.

Fortunately it's a .tar.gz rather than an executable, so the amount of harm SourceForge can do is limited.

Sourceforge's new owners claim[0] they stopped doing that stuff. I haven't checked to see if it's true but I know it's been discussed on HN before.

[0]https://sourceforge.net/blog/sourceforge-acquisition-and-fut...

How so? They could drop an executable named "configure" in the tarball. I don't think they would, but they're not really limited by the format.

We're going to need a SHA-1 or something - they could just rezip the compromised binary.

Indeed. People interested in open source for this type of stuff are usually interested in security.

Recommend moving the project.

People who are interested in security would be verifying the pgp signature on the tarball. (What's that? It's unsigned?)