[tjpnz]

>Naive question. How does one know this is malicious before installing it?

You can't, that's the problem.