marketplace and malicious code in modules/addons

when users/sellers or companies add modules and addons to the marketplace are they tested or checked for malicious code, or is this buy/use at our own risk?

Only companies / developers approved by OpenCart can sell their extensions. Hence, it would be better to get those paid ones. However, there are some paid developers that do not code well, so it's ultimately better to find an extension from a reputable company.

While most developers on the marketplace are trustworthy, you do still need to be careful about what you install. To be clear, extension code is NOT checked by anyone on the OpenCart team, so there's the potential for a malicious developer to get an extension in there. They should get flagged/removed fairly quickly, but only if someone purchases the extension and checks the code. It'd be pretty rare for a malicious developer to get in there, but if you don't know how to check code yourself, I'd stick with developers that have good sales and ratings history.