Open the main PHP or JS files in a text editor like Notepad++. Look for long strings of gibberish like eval(base64_decode('...')) . Legitimate code is readable. Obfuscated code is a trap.
Payment does not equal security. You can buy a $300 script from a random developer’s website that still contains vulnerabilities. Verification requires third-party or platform-based auditing.
Upload the script’s ZIP file to VirusTotal (free). It uses 60+ antivirus engines. If any flag says "Backdoor" or "Webshell," delete the file immediately.