Can AppImages contain malware, and how risky are they compared with repository packages?

Yes, an AppImage can contain malware. It's a way to package and run an application, not a security guarantee. Once you run one, it can generally do things your user account is allowed to do.

The developer's site is a better starting point than an unrelated download page, but it isn't foolproof. A legitimate site or release process could be compromised. The question is whether you trust both the publisher and the path the file took to reach you.

I'd generally prefer a package from a distribution's official repository when one is available. Repository signatures and the distribution's review and update processes can provide useful checks that a random download might not have.

That doesn't make repositories immune. A compromised dependency, maintainer, or build process can still affect a package. Also, adding a third-party repository means placing trust in whoever maintains it, not just in your distribution.

The format isn't the only place this risk shows up. Third-party packages, browser extensions, development libraries, and other software downloads all have their own trust chains. Switching formats alone won't solve the problem.

For an AppImage, check that you're getting it from the project's intended release source, and verify a signature if the project provides one and you can establish that the signing key is genuine. A checksum can catch a corrupted download, but a checksum obtained from the same compromised page may not expose a malicious replacement.

If the application doesn't need access to sensitive files, running it in a suitable sandbox can reduce what a compromised app can reach. An AppImage doesn't automatically provide that isolation.