How to spot backdoor addons?

Well, you'll need to learn how to read code - that's a given.
But you should definitely see what the music file is called, and run ctrl+f in all of the .lua files of it.

Keep in mind, some backdoors are pretty hard to remove, my friend got rid of all of the backdoor stuff from her leaked gmod addons, but still had it crash on her.
That stuff is insidious.