As someone who doesn't own software I buy from major companies, but continues to collectively own old versions of October CMS, I don't feel much malware. There's still a good deal of actual software here.