https://github.com/biblepay/biblepay

You're free to run a diff between the Biblepay source and Dash from which it was forked and point out any malware insertions. Being cautious is fine, but there's no need for insults. You're not going to find many projects derived directly or indirectly from BTC that don't set off false positives in any number of malware detection programs for reasons stated above.