Heads up: Sourceforge upstream attacked