Chrome for example has a sort of a bloom filter which is used to check all downloaded executables. This will raise a nasty warning if the thing you downloaded is not a "popular" download.
For obvious reason, this check is disabled for a bunch of sites, like github, sf, ...
I know for a fact that some malware authors host their stuff on GitHub exactly to bypass this Chrome check.
