I'm really finding this hard to believe. It's just incredible. I mean, I've had a bit of a love-hate relationship with SF.net forever, but it's always been the kind of thing you might have with a bratty sibling (i.e. you wish they were doing more with their lives, but you still love them). This is such a massive betrayal of trust that I can't even swallow it.

I mean, the evidence seems to be there, and more than one major project has reported this behavior, so it's not really something I can just ignore. But, it's also just so horrible. (I'm beginning to become repetitive. I just really find this unbelievably awful.)

I don't know anyone involved in SourceForge, and haven't in more than a decade, so I don't even know who to reach out to for some kind of clarification about WTF they think they're doing. Their mirror page doesn't explain anything about distributing malware in these projects they "maintain", so they're already not being forthright about it.

They claim (at the bottom of http://sourceforge.net/mirror/) that "If you have an Open Source project outside of SourceForge, we'd like to hear from you. If you want your project mirrored on our site, or if you don't want your project mirrored on our site, please let us know. Or there's any other service that we can extend to your project community, we'd like to hear that, too. Contact us at [email protected] and we'll be sure the message gets to the right people."

People should email them at [email protected] and ask to be un-mirrored. Maybe that will work.