SourceForge locked in projects of fleeing users, cashed in on malvertising [Updated]