The vast majority of GTA mods are not malware. Some are. The malicious ones tend to follow patterns. We work through them.
The pattern
A mod is uploaded to a low-moderation site. The bundled files include not just mod content but malicious executables. The user installs the bundle and runs the malware unintentionally.
The malware tends to be cryptojackers, info-stealers (cookies, browser passwords) or remote-access tools.
Warning signs
Mod requires administrator privilege to run. Bundled .exe files outside the game folder. Mod uses obfuscated installer. Mod requests unusual system permissions. Mod download is unusually small or large for what it claims to do.
Comments warning of antivirus flags - believe them.
How to protect yourself
Download from reputable sites only. Run downloads through VirusTotal before installing. Use a separate Windows account for modding if you're paranoid. Back up before any install.