malicious code bundled on sourceforge