I used something like this:
https://www.spigotmc.org/resources/spigot-anti-malware-detects-over-200-malicious-plugins.64982/

And it detected something like this:
[08:15:37] [DETECTED]: AuthMe-5.6.0-SNAPSHOT.jar MIGHT be infected with Annoyance (MALWARE) Class path: com/sun/mail/util/logging/LogManagerProperties ; Line/SourceFile 5 471/LogManagerProperties.java
Is this a fake notification or something in your plugin to improve?

Totally a false report... that's a class includes in a very common library used by many other projects.