I'd amend that to "someone evil who's built up a 'good' reputation for long enough that they dominate search rankings...." I don't know that what sourceforge is doing is a unique situation, but it's AFAIK not a common one. It's not going to have the same effect if I start bundling open source installers with malware and hosting them on my own, for example.