Windhawk mods are distributed as source code and WH itself compiles it. It works the same way usescripts work with tampermonkey/violentmonkey on browsers.
If a mod includes malware it'll be very obvious as mods are usually small.
If a mod includes malware it'll be very obvious as mods are usually small.
There's a malware risk in literally every piece of software. Windows itself behaves as malware with all the telemetry it gathers.
Just like Windows. /s