It is not uncommon for [news warning about malicious apps that have entered the Play Store][1] to appear fairly regularly.

The common advice is to read reviews and check the app's ratings.
However, attackers also do [fake reviews and comments][2].

**Question 1:** What sort of criteria have stood the test of time to avoid this sort of malware?

- comments can't be trusted.
- rating can't be trusted.

At the moment, time of existance, e.g. 2+ years, is the only one I think is feasible.<br>
Can it be trusted too? And what else is important?

**Question 2:** Is there a curated list of trustworthy apps?

Currently, APK Mirror seems to be the best alternative since the apps there are curated by them. But they don't allow paid-apps.


  [1]: https://www.wired.com/story/google-play-store-malware/
  [2]: https://www.androidauthority.com/fake-reviews-play-store-reportedly-growing-761928/