I haven't trusted anything from SourceForge since they were compromised 4 years ago, regardless of their 'data validation'.

https://sourceforge.net/blog/sourceforge-attack-full-report/