It's not even SEO here. It's Google ads from hijacked accounts. You can just run ads on open source software keywords and bam, top result is your malware. Since very few others will advertise on oss.

We had to deal with attacks on freecad and kicad last year via dozens of hijacked AdWords accounts and had to use a back channel at Google to get them removed.