I always look look at the code in all files of a module before installing it.
If you find some kind of link to a website, this is a warning.
If you find any code that looks similar as the code below, it's most likely malware!
public function installCertificate()
{
return...