A project name cannot prove that every file carrying that name is safe. The right question is whether the specific archive came from a trustworthy source, matches the expected file type, and behaves like a normal mod package.
Check the exact source and file type
A normal source ZIP contains readable project files. A normal compiled mod is commonly a JAR. Be cautious when a download instead provides an unrelated installer, script, password-protected archive, or executable.
Scan the file locally
Use an updated security tool to scan the archive and extracted contents. A clean result is one signal, not a substitute for checking origin and behavior.
Avoid credential requests
A client mod should not require you to type an email password, account token, or payment information into a separate installer. Close and remove any package that makes unrelated requests.
Use an isolated profile
Test new files in a separate Minecraft directory with no valuable worlds. Isolation limits the impact of a broken or suspicious package and simplifies cleanup.
Respond to suspicious behavior
Disconnect the profile, remove the file, scan the system, review startup entries, and change credentials only when there is evidence they may have been exposed.