Using Virustotal to check for malicious code seems like a good first pass but no guarantee. That asset could easily contain some naughty tracking code that isn'

Using Virustotal to check for malicious code seems like a good first pass but no guarantee. That asset could easily contain some naughty tracking code that isn't considered malicious enough, or is new enough not to be detected. We can surmise that Unity likely scans assets with commercial solutions, so if malware makes it through to the asset store, we can assume Virustotal wouldn't detect it.