How would you avoid potentially dangerous apps in the Play Store edit: The goal of the question is to create a simple checklist for novice users.

It is not uncommon for news warning about malicious apps that have entered the Play Store to appear fairly regularly.

The common advice is to read reviews and check the app's ratings.
However, attackers also do fake reviews and comments.

Question 1: What sort of criteria have stood the test of time to avoid this sort of malware?


comments can't be trusted.
rating can't be trusted.


At the moment, time of existance, e.g. 2+ years, is the only one I think is feasible.
Can it be trusted too? And what else is important?


Yes or No criteria is preferable
False positives are better than missed malware


Question 2: Is there a curated list of trustworthy apps?

Currently, APK Mirror seems to be the best alternative since the apps there are curated by them. But they don't allow paid-apps.
While I mostly agree to Yaksha's answer, I still want to partly oppose it – and of course will include my reasons:


Instead of using Playstore, stick with F-Droid whenever possible.
F-Droid only serves open-source apps – so other than what Yaksha wrote about Playstore apps, you can look into the source. But most users won't be that "techy" to really understand it. Which is why the F-Droid team does that for you: they compile from the sources they have checked before (and they have a community supporting them). Plus, they have very strong inclusion criteria an app must meet to be allowed into their repository. So you e.g. won't find apps with proprietary ad or tracking modules there. Plus, so-called AntiFeatures are always pointed out. No way a dev can "hide" that by keeping it out of the app description.
When you have to use Playstore, cross-check the apps with Exodus.
Exodus grabs free (non-paid) apps from Play Store and analyses their code to detect trackers. It then points out how many of those it found and which ones. You can even read details on most of those "privacy snoopers" to know what they do. But they can only grab apps which require no payment.
For paid apps: AppBrain.
AppBrain offers an alternative front-end to what you find on Playstore – same data actually, and for installing an app you'd even be redirected to Playstore. But they add a bunch of useful information on top by checking the libraries an app contains, and grouping them so you can easily spot ads and analytics. Unfortunately, since summer 2017 free access is limited to 5 apps per day (creating a free account, you can top that up to 10).
Before installing a new app, cross-check with forums.
Often, a simple search (using the engine of your choice) gives plenty of useful hints – e.g. latest reports if an app had "conspicuous activity". For example, Cheetah Mobile's "Security" apps caused a big uproar lately as they called up to porn pages in background. With that search you can also find "external reviews" – though most of those usually concentrate more on the features than on security or privacy (a big exception is the German portal MobilSicher which does it just the other way around).


To make those steps easier, when looking for a new app you can use my app listings as a starting point. There you find the apps ordered by ratings – but with useful annotations: number of permissions requested (and details on them), availability on different places (e.g. F-Droid and Playstore), links to reviews, marks on critical libraries used, and more. It's not the full load of apps available worldwide, but a good hand-selected amount (about 14k currently).

Another word: don't rely on so-called "Anti-Virus" apps – they are mostly snake-oil. For references on this statement, please check e.g. Is there really such a thing as an Android virus?, Android antivirus apps are useless — here’s what to do instead and Antivirus software is snake oil!.

And yes, of course use your "common sense" when taking a look at the permissions an app requests: are they really justified by the purpose? Though admitted, that's not as easy as it sounds. While it might be clear a torch doesn't need access to your contacts – could you guess if access to your camera might be justified? Spoiler: indeed, to fire the flashlight it might be needed. When in doubt, compare with other apps offering the same feature set. If one app needs 24 permissions for something another can do with 5, you can be almost sure the difference of 19 is needed by some ad or tracking module. Again, my above mentioned app listings make such comparisons easier. To pick up an earlier example again: if one app was brought up obviously malicious, avoid all other apps from the same dev as well – chances are rather good they have similar issues (so: no Cheetah Mobile, for example).