please provide any sort of source that Audacity is, or ever has been, distributing malware.

He has none and has been trying to depict Audacity as a Russian malware vector for over a year now, but without providing any source.