I have never heard of any addon being used as malware. Especially since it’s in python and people easily have access to it’s code. With that said I agree with Adrian on using some caution. Now there have been fake Blender downloads that had Malware so I always download blender from blender.org.
