1. Search for the Official Sources

DNF and Flathub are the official sources.
2. Check the SSL Certificate of the Website

Irrelevant. Compromised mirrors don't really matter because if they mess with a package, it won't be signed properly anymore and the GNU/Linux distribution won't agree to install it, and will warn the user.
3. Check Domain TLD

Irrelevant. If a package doesn't have a signature match, it can't be installed, plus APT, DNF, and Flatpak only use the official mirror or repo address they were originally configured for or a redirect offered by the distribution's server.
4. Check Domain Age

Irrelevant. If a package signature doesn't match, it won't be installed. Who cares what mirror it came from or how recently it was added?

5. Look for Website Reviews

Irrelevant. If a package signature doesn't match a signing key from the distribution or approved of and added by the user, it won't be installed.

6. Scan the File Download Link With Online Scanner Tool

Mostly irrelevant. If you want to, you can scan an RPM or Debian package if you're about to install one locally, and it may not be a bad idea, but first you should try locating it from a more official source, where it will be verified and signed. If you proceed to install it, perhaps all of these tips do apply, but since most users have 1 or 2 packages like this on their system at most, it's not likely they'll get malware.

7. Keep an Eye on the File Extension

On a GNU/Linux system, the user normally has to make it possible to execute a file if they simply downloaded one.

If Wine is installed and the user is attempting to run a Windows application, this can be relevant, as are all 7 steps pointed out here, even though Wine isn't Windows and most Windows viruses fail to do their assigned task in Wine, it is a good idea to be highly skeptical of Windows software and proceed with extreme caution, if proceeding at all.