It takes quite a bit of effort to determine that a repo is free of malware - very likely more effort that the coding challenge itself. And I would not rely on antivirus software.

Checking the background of the hiring company may help. Check the investors, board of directors, founders to make sure they are real and have a backstory. Search TeamBlind or Glassdoor for complaints.