Funny thing, I wrote software reviews (or rather comparisions) professionally for five years. To ensure a fair review and a round article four different people were involved:
First: Me as the writer
Second: My editor. She checked my research for errors. Tested the things I had tested and described, to make sure the errors I found weren't just temporary glitches, or errors on my side, and that I didn't have overlooked anything.
Third: The chief-editor who looked, after the article was finished and edited with a fresh and unbiased eye, if everything was smooth, logical and if we provided a good journalistic quality.
Fourth: the final editor that just looked after the grammar and spelling to catch any error that might have escaped three persons.
My editor usually liked me being very direct about the quality of the software and if a tool was bad I was allowed to write that the tool was bad. Sometimes my frustration about a very rough testing-period showed in my writing and then she softened my words a bit. But on one ocassion she hated a tool even more than I did and she puts a harsh spotlight on the limits and errors.
Of course, we always kept a somewhat professional tone, like writing "the tool isn't able to keep the advertised promises" or "it worked as stable as a direction indicator: on - off - on - off" but not "the programmers are complete morons".
IF there were serious problems, we said so, without being extremely nice to the feelings of the programmers. In the end we didn't write for the programmers. We wrote for the readers and they should know which tool was worth a look and which tool just would be a waste of their time.
In your case: you found Malware. Why on earth do you want to go easy on programmers who put their users at risk? Maybe with full intent? You write for your readers. Put a big warning label on top of the article, that this tool contains malware.