This is why you should test the plugin on a local machine.
Firstly - virus check it with
https://www.virustotal.com/gui/home/upload. Its free
Secondly - never download it from a user that has shared it, unless they are a trusted uploader/moderator. Why is
@Phan Duy Nam allowed to upload this
@TassieNZ and
@Tomz? Surely we remove user uploads and go down the direct request route? I wouldn't download from this user.
Thirdly - Use a peace of software called "
WinMerge" or "
Visual Studio Code" to compare untouched with nulled. Also check it against a previous version that was nulled and is clean as well as downloaded from a trusted user/moderator.
Finally - always test on a local/staging site that sits outside of your live environment. Use plugins like Anti-Malware Security and Brute-Force Firewall -
https://en-gb.wordpress.org/plugins/gotmls/ and do a scan to be 100% sure. Check your local against live to see any odd file changes - making sure your content/plugin list is identical (minus version controls).
UPDATE: Another tool to use that I swear by and find very useful for testing/backing up a live site is LocalWP -
https://localwp.com. It might not be as fast as other local tools but its easier to use, and manage and is backed by a large following of users that are willing to help if you have any issues.
All the above is common sense when using legit/nulled plugins. You never know what an update can do to a site. I have learned to never update live due to plugins breaking a function or the site in general. TEST LOCALLY!!
I'm going to ad this to my footer signature. It cant be stressed enough

.