- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Today I found a GPLed project on SourceForge whose executables are spreading a virus. This fact has been pointed out several times in reviews of the project and the infected executable is still available for download. Apparently, older executables are not infected, so the project itself does not seem to be made with malicious purpose in mind. There is no preferred way to contact developers and forums for the project are dead. What should I do?
If you can't get in touch with the developers, then contact SourceForge. Report the problem, give them detailed information they can use to verify the issue, and they'll (probably) take it down. They're a reputable site and I imagine they wouldn't want to be associated with malware.