edit: The goal of the question is to create a simple checklist for novice users.
It is not uncommon for news warning about malicious apps that have entered the Play Store to appear fairly regularly.
The common advice is to read reviews and check the app's ratings. However, attackers also do fake reviews and comments.
Question 1: What sort of criteria have stood the test of time to avoid this sort of malware?
- comments can't be trusted.
- rating can't be trusted.
At the moment, time of existance, e.g. 2+ years, is the only one I think is feasible.
Can it be trusted too? And what else is important?
- Yes or No criteria is preferable
- False positives are better than missed malware
Question 2: Is there a curated list of trustworthy apps?
Currently, APK Mirror seems to be the best alternative since the apps there are curated by them. But they don't allow paid-apps.