I still have in my mind the situation with CurseForge, when there attackers gained access to the accounts of mod developers for Minecraft and uploaded "new mods versions" with a virus stuffed in it.
Perhaps.
I don't want to get too deep into a discussion on someone's game forum, heh. Ultimately, make your own call for what makes you feel comfortable.
For fun, I tested a few things on virus total in the last few minutes. The following are detected as viruses right now:
- VLC media player (64bit) Windows- vlc-3.0.20-win64.exe
- Firefox browser 64-bit Windows installer - Firefox Installer.exe
- Drobbox 64-bit Windows desktop installer - DropboxInstaller.exe
- 7zip Windows 64-bit beta version installer - 7z2404-x64.exe
- Winrar 32-bit Windows installer - winrar-x32-700.exe
- GoG Galaxy installer for 64-bit Windows - GOG_Galaxy_2.0.exe
- Notepad++ 32-bit installer - npp.8.6.5.Installer.exe