Hmmm, incredibly strange. Thanks for checking them out for me. I used to work with another dev, and he found the exact same one.
Check if all the creators are legit. Sometimes people make groups with the same name as the original creator name, and upload the backdoored plugin there.
Yeah, ive heard of that before, I also check the comments, how many likes (determining how many people have it) and the create sometimes.