Has anyone else received a suspicious client repository?

A few days ago i downloaded a project from a potential client, and Windows Defender immediately flagged a malware before I even opened the project. It amde me realize how much trust we put into random ZIP files and GitHub repositories from people we've never worked with.

It got me thinking;

before opening a client project, how do you know it's actually safe?

Do you?
-Just trust Windows Defender?

-Open it in a VM?

-Read through the code manually?

-Have another workflow?

I'm curious because I'm considering building a tool that statistically scans a repository (without executing it) and highlights things like:

-Suspicious install scripts (preinstall, postinstall)

-Dangerous PowerShell/Bash scripts

-Obfuscated binaries

-Suspicious binaries

-Exposed secrets

-Vulnerable dependencies

The goal wouldn't be to claim repository is "100% safe" just to give developers a risk report before they open or run anything.

Is this a problem you've actually faced, or was my experience just an edge case?

I'd love to hear how you currently handle this.