Of course some sick individual could put malware in Menyoo code, recompile it, and upload it as a Menyoo update or new Trainer and provide a mediafire link. Other asi mods could be harmful.
Which is one of the reasons we generally require that offered uploads are accessible via 5mods itself. Menyoo (and a few others) are allowed via github, because it's become an established, trusted source, and indeed comes with the actual source code.
As a rule of thumb, though: don't download things like Menyoo (especially not compiled versions) from anywhere, but a known, trusted source (the author itself, in this case). That's like warning people not to download Windows dll's from some sus, third-party: it should be obvious.