You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload fe

You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload feature your tests should check that your file type filtering actually works, that things in your upload directory aren't executable, that you can't upload to the path of an existing file, and so on. You should build with security in mind, and test that the code you wrote does what you think it should do, and that it doesn't do things it shouldn't do.