[Pidgin] #16580: Pidgin installer is malicious?

[Pidgin]

#16580: Pidgin installer is malicious?
---------------------+----------------------------------------------
 Reporter:  earnoth  |      Owner:
     Type:  defect   |     Status:  new
Milestone:  2.10.12  |  Component:  pidgin (gtk)
  Version:  2.10.11  |   Keywords:  pidgin infected malware security
---------------------+----------------------------------------------
 I'm experiencing this same activity as
 https://developer.pidgin.im/ticket/15807#no4.

 When I visit ​​http://pidgin.im/download/ and I click download for Win32,
 I'm sent to this link:
 ​http://hivelocity.dl.sourceforge.net/project/pidgin/Pidgin/2.10.11/pidgin-2.10.11.exe

 I've tried this twice, and each time Chrome complains that the file is
 malicious.

 I uploaded it to VirusTotal?, which says the AV vendor "Rising" claims it
 is infected by "PE:Trojan.Win32.Generic.141A9A33!337287731".
 ​https://www.virustotal.com/en/file/2a2c58cba5f9360f5f48cc59ccb5e1f82d59c3cc87a52648e9bd45b3968e10e3/analysis/1424271804/

 The SHA256 for the file is
 2a2c58cba5f9360f5f48cc59ccb5e1f82d59c3cc87a52648e9bd45b3968e10e3

--
Ticket URL: <https://developer.pidgin.im/ticket/16580>
Pidgin <https://pidgin.im>
Pidgin