Though the amount of downloads means nothing (see Lenovo's Superfish), you're counting all downloads of LCPDFR, when the only version that has the malware is the latest 1.0d.
Please look up what Malware is, than look up what opencandy is.
I don't care who I'm talking to, unless you know these people personally you can't make blanket assumptions about their character or their motives.
I'm not saying the Opencandy software/malware is screwing people over, but if you're going to bundle your mod with such risky software, there needs to be a disclaimer.
I highly doubt you know anything about it either, see, we can both talk out of our ass, makes no difference. Why would I waste my time analyzing a simple mod when the problem is clear? Virustotal does a damn good job with preliminary findings, there is nothing new, exciting, or unique about what's going on here. Standard bundle software with crapware. At least have the dignity of placing disclaimers.