Run them in a test sandbox environment, maybe run some network analytics to see if weird outbound or inbound calls start getting made... hope they are not more clever than your sandbox environment.

For APKs specifically... official support for Hypatia from the original team ended last year, but a 'MaintainTeam Organization' seems to be attempting to pick up the slack, and keep updating with new malware signatures.

https://apt.izzysoft.de/fdroid/index/apk/org.maintainteam.hypatia

https://github.com/MaintainTeam/Hypatia

... not sure if its... actually getting regular updates though.

EDIT: derp, yeah

Also, as upstroke says, do a hash comparison from the actual proper source to verify you aren't getting a malformed or spoof version of whatever APK.