That's not quite accurate... FileZilla has opted into the bundle-with-crapware program [1] to make some money.

[1] https://news.ycombinator.com/item?id=8849950

SourceForge are adding the malware but the FileZilla people are acting as if it's not a problem and refusing to help people / accept that there is an actual virus in the executable they link on their site.

"It's not our problem, it's SourceForge" - stop f'ing using SourceForge then!

Their ambivalence and complicity in distributing this malware is probably the behaviour GP was talking about.

I had contacted FileZilla's developer about this back in 2014.

He let me know that bundling crapware was "intentional"

http://i.imgur.com/AvfDuOA.png

His statement about alternate download links was also incorrect, because I was asking about Filezilla server, which I could not find anywhere but sourceforge.

The problem is that Google still rank SourceForge highly.

If Google ranked them down, then they harm would be limited.