Guilt by association? Perhaps SF is not the true source of badness/malware but instead they tend to host the projects most likely to include such malware.